« Volver al listado

CVE-2025-41768

Estado: AplazadaMedia (5.5)—

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting').

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41768",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41768",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-20T19:30:51.378202Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "Beckhoff Automation",
          "product": "TwinCAT.HMI.Server",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "14.4.267",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Beckhoff Automation",
          "product": "TF2000-HMI-Server",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "14.4.267",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Beckhoff Automation",
          "product": "tf2000-hmi-server",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "14.4.267",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-20T09:15:59.123",
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2025-106",
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation ('Cross-site Scripting')."
    },
    {
      "lang": "es",
      "value": "En una instancia de TwinCAT 3 HMI Servidor ejecutándose en un dispositivo, un administrador autenticado puede inyectar contenido arbitrario en el campo CSS personalizado, que se persiste en el dispositivo y luego es devuelto a través de la página de inicio de sesión y la página de error."
    }
  ],
  "lastModified": "2026-06-17T09:23:08.383",
  "sourceIdentifier": "info@cert.vde.com"
}