Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

An administrator could inject malicious JavaScript code that executes in the browser of other users accessing the HMI Server login or error pages, potentially stealing credentials or redirecting users to malicious sites. This could disrupt visibility into plant operations or compromise access to control interfaces.

Manufacturing organizations running TwinCAT 3 automation software with the optional HMI Server component are affected. Specifically, operators and administrators who access the HMI Server web interface for remote monitoring or control are at risk if an administrator has been compromised or acts maliciously.

An attacker with administrative credentials accesses the TwinCAT 3 HMI Server configuration page and injects malicious JavaScript into the CUSTOM_CSS field. When other users (operators or additional administrators) visit the login page or encounter an error page, the JavaScript executes in their browser, allowing credential theft or further compromise of the HMI interface.