Search criteria
2 vulnerabilities by Beckhoff Automation
CVE-2025-41768 (GCVE-0-2025-41768)
Vulnerability from cvelistv5 – Published: 2026-01-20 08:02 – Updated: 2026-01-20 19:32
VLAI?
Title
Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server
Summary
On an instance of TwinCAT 3 HMI Server running on a device an authenticated administrator can inject arbitrary content into the custom CSS field which is persisted on the device and later returned via the login page and error page.
Severity ?
5.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Beckhoff Automation | TwinCAT.HMI.Server |
Affected:
0.0.0 , < 14.4.267
(semver)
|
||||||||||||
|
||||||||||||||
Credits
Roby Firnando Yusuf from Jeonbuk National University
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-41768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-20T19:30:51.378202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T19:32:34.439Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TwinCAT.HMI.Server",
"vendor": "Beckhoff Automation",
"versions": [
{
"lessThan": "14.4.267",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "TF2000-HMI-Server",
"vendor": "Beckhoff Automation",
"versions": [
{
"lessThan": "14.4.267",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "tf2000-hmi-server",
"vendor": "Beckhoff Automation",
"versions": [
{
"lessThan": "14.4.267",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Roby Firnando Yusuf from Jeonbuk National University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "On an instance of TwinCAT 3 HMI Server running on a device an authenticated administrator can inject arbitrary content into the custom CSS field which is persisted on the device and later returned via the login page and error page.\u003cbr\u003e"
}
],
"value": "On an instance of TwinCAT 3 HMI Server running on a device an authenticated administrator can inject arbitrary content into the custom CSS field which is persisted on the device and later returned via the login page and error page."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-20T08:02:53.356Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://certvde.com/de/advisories/VDE-2025-106"
}
],
"source": {
"advisory": "VDE-2025-106",
"defect": [
"CERT@VDE#641900"
],
"discovery": "UNKNOWN"
},
"title": "Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2025-41768",
"datePublished": "2026-01-20T08:02:53.356Z",
"dateReserved": "2025-04-16T11:18:45.761Z",
"dateUpdated": "2026-01-20T19:32:34.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-34594 (GCVE-0-2021-34594)
Vulnerability from cvelistv5 – Published: 2021-11-04 09:50 – Updated: 2024-09-16 22:03
VLAI?
Title
Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server
Summary
TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.
Severity ?
6.5 (Medium)
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Beckhoff Automation | TwinCAT OPC UA Server |
Affected:
TF6100 , < 4.3.48.0
(custom)
Affected: TS6100 , < 4.3.48.0 (custom) Affected: TcOpcUaServer version , < 3.2.0.19423 (custom) |
Credits
Beckhoff Automation thanks Johannes Olegård, Emre Süren, and Robert Lagerström for reporting the issue and for support and efforts with the coordinated disclosure.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:19:46.994Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-051/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TwinCAT OPC UA Server",
"vendor": "Beckhoff Automation",
"versions": [
{
"lessThan": "4.3.48.0",
"status": "affected",
"version": "TF6100",
"versionType": "custom"
},
{
"lessThan": "4.3.48.0",
"status": "affected",
"version": "TS6100",
"versionType": "custom"
},
{
"lessThan": "3.2.0.19423",
"status": "affected",
"version": "TcOpcUaServer version",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Beckhoff Automation thanks Johannes Oleg\u00e5rd, Emre S\u00fcren, and Robert Lagerstr\u00f6m for reporting the issue and for support and efforts with the coordinated disclosure."
}
],
"datePublic": "2021-11-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-11-04T09:50:09",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-051/"
}
],
"solutions": [
{
"lang": "en",
"value": "Please update to a recent version of the affected product (TF6100 or TS6100 version \u003e= 4.3.48.0)"
}
],
"source": {
"advisory": "VDE-2021-051",
"discovery": "EXTERNAL"
},
"title": "Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-11-04T06:00:00.000Z",
"ID": "CVE-2021-34594",
"STATE": "PUBLIC",
"TITLE": "Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TwinCAT OPC UA Server",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "TF6100",
"version_value": "4.3.48.0"
},
{
"version_affected": "\u003c",
"version_name": "TS6100",
"version_value": "4.3.48.0"
},
{
"version_affected": "\u003c",
"version_name": "TcOpcUaServer version",
"version_value": "3.2.0.19423"
}
]
}
}
]
},
"vendor_name": "Beckhoff Automation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Beckhoff Automation thanks Johannes Oleg\u00e5rd, Emre S\u00fcren, and Robert Lagerstr\u00f6m for reporting the issue and for support and efforts with the coordinated disclosure."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-23 Relative Path Traversal"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/en/advisories/VDE-2021-051/",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en/advisories/VDE-2021-051/"
}
]
},
"solution": [
{
"lang": "en",
"value": "Please update to a recent version of the affected product (TF6100 or TS6100 version \u003e= 4.3.48.0)"
}
],
"source": {
"advisory": "VDE-2021-051",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-34594",
"datePublished": "2021-11-04T09:50:09.275622Z",
"dateReserved": "2021-06-10T00:00:00",
"dateUpdated": "2024-09-16T22:03:44.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}