CVE-2025-41768: Beckhoff Automation TF2000-HMI-Server

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').

Affected products

• Beckhoff Automation TF2000-HMI-Server: from 0.0.0, before 14.4.267 (fixed in 14.4.267)
• Beckhoff Automation Twincat.hmi.server: from 0.0.0, before 14.4.267 (fixed in 14.4.267)

Published 2026-01-20. Last modified 2026-06-17.