Beckhoff TwinCAT 3 HMI Server Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in Beckhoff TwinCAT 3 HMI Server components prior to version 14.4.267. This issue allows authenticated administrators to inject arbitrary content into a custom CSS field. The injected content is persisted on the device and subsequently rendered on the login and error pages. Exploitation of this vulnerability requires malicious intent, as it involves the misuse of administrative privileges.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected content is executed in the context of the user's browser.

Remediation

Users are advised to update to a recent version of the affected components.