CVE-2025-41768: TwinCAT 3 HMI Server XSS Vulnerability

CVE-2025-41768 Overview

CVE-2025-41768 is a stored Cross-Site Scripting (XSS) vulnerability affecting Beckhoff TwinCAT 3 HMI Server. An authenticated administrator can inject arbitrary content into the custom CSS field, which is persisted on the device and subsequently returned via the login page and error page. This vulnerability allows malicious content to be served to any user accessing these pages, potentially leading to session hijacking, credential theft, or further attacks against users of the HMI system.

Critical Impact

Authenticated administrators can inject persistent malicious content that affects all users accessing the login and error pages of the TwinCAT 3 HMI Server, potentially compromising Industrial Control System (ICS) environments.

Affected Products

• Beckhoff TwinCAT 3 HMI Server

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-41768 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-41768

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The TwinCAT 3 HMI Server provides administrators with the capability to customize the appearance of the web interface through a custom CSS field. However, the application fails to properly sanitize or validate the input provided in this field before storing it and subsequently rendering it on the login and error pages.

The stored nature of this XSS vulnerability makes it particularly dangerous in industrial control system environments. Once malicious content is injected by a compromised or rogue administrator account, it persists on the device and is served to every user who accesses the affected pages. This can include operators, engineers, and other personnel accessing the HMI interface.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and output encoding within the TwinCAT 3 HMI Server's custom CSS handling functionality. The application accepts arbitrary content in the CSS field without proper sanitization, allowing attackers to inject HTML or JavaScript code that escapes the CSS context. When the login or error pages are rendered, this malicious content is included without proper encoding, resulting in the execution of attacker-controlled scripts in the context of the victim's browser session.

Attack Vector

The attack requires authentication with administrator privileges to the TwinCAT 3 HMI Server. An attacker with these privileges can navigate to the customization settings and inject malicious payloads into the custom CSS field. The payload is then stored server-side and served to all subsequent visitors of the login and error pages.

This network-accessible vulnerability can be exploited by attackers who have obtained administrator credentials through phishing, credential stuffing, or insider threats. The injected content could redirect users to phishing pages, steal session tokens, or perform actions on behalf of authenticated users. In ICS environments, this could lead to unauthorized access to operational technology systems.

Detection Methods for CVE-2025-41768

Indicators of Compromise

• Unusual or unexpected content in the custom CSS configuration field of TwinCAT 3 HMI Server
• Presence of <script> tags, JavaScript event handlers, or encoded payloads within CSS configuration
• User reports of unexpected browser behavior or redirects when accessing the HMI login or error pages
• Audit logs showing modifications to custom CSS settings by unexpected or compromised administrator accounts

Detection Strategies

• Implement regular audits of TwinCAT 3 HMI Server configuration settings, particularly the custom CSS field
• Deploy web application firewalls (WAF) to detect and block XSS payloads in administrative submissions
• Monitor HTTP responses from the HMI Server for unexpected JavaScript content in login and error pages
• Establish baseline configurations and alert on any deviations in the CSS customization settings

Monitoring Recommendations

• Enable comprehensive logging of all administrative actions on TwinCAT 3 HMI Server
• Configure SIEM alerts for changes to web interface customization settings
• Implement integrity monitoring for HMI Server configuration files
• Review authentication logs for administrator accounts accessing CSS customization features

How to Mitigate CVE-2025-41768

Immediate Actions Required

• Review and validate the current content of the custom CSS field in all TwinCAT 3 HMI Server instances
• Remove any suspicious or unexpected content from the CSS customization settings
• Audit administrator account access and revoke unnecessary privileges
• Implement network segmentation to limit access to HMI Server administrative interfaces

Patch Information

Consult the CERT@VDE Security Advisory VDE-2025-106 for official patch information and remediation guidance from Beckhoff. Apply vendor-provided security updates as soon as they become available.

Workarounds

• Restrict network access to the TwinCAT 3 HMI Server administrative interface to trusted IP addresses only
• Implement multi-factor authentication for administrator accounts where supported
• Disable or limit the use of custom CSS functionality if not operationally required
• Deploy Content Security Policy (CSP) headers at the network level to mitigate XSS impact
• Conduct regular security reviews of all administrator-level configuration changes

# Example: Restrict administrative interface access via firewall
# Allow only trusted management network to access HMI Server admin port
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP