CVE-2025-41768CWE-79

Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

Medium · published January 20, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-20T08:02Z
EPSS history
Timeline
  • 20 JAN 08:02Z
    Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
    cvelistv5