PT-2026-3546 · Beckhoff Automation · Twincat 3 Hmi Server

CVE-2025-41768 · Publicado 2026-01-20 · Atualizado 2026-01-20

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TwinCAT 3 HMI Server (affected versions not specified)

Description An authenticated administrator can inject arbitrary content into the custom CSS field within TwinCAT 3 HMI Server. This injected content is saved on the device and subsequently returned through the login page and error page. The issue involves the ability to modify the visual presentation of these pages, potentially leading to phishing or other malicious activities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-41768

Produtos afetados

Twincat 3 Hmi Server

Referências · 6

• https://t.me/CVEtracker/42605 · Publicação no Telegram
• https://t.me/cveNotify/149254 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2013685241966116914 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2013536599905018299 · Publicação no Twitter
• https://certvde.com/de/advisories/VDE-2025-106 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-41768 · Nota de Segurança