Most recent entries from csaf_pilzgmbhcokg

PPSA-2026-003 — Pilz: Multiple Vulnerabilities affecting industrial PC IndustrialPI

Tue, 04 Aug 2026 10:00:00 +0000

The Linux kernel used in the IndustrialPI, 'linux-image-revpi-v8', prior to version 6.12.91-revpi0-rpi-v8 contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can give an attacker full control over the device.

PPSA-2026-002 — Pilz: Vulnerability affecting PASvisu Runtime

Thu, 23 Apr 2026 12:00:00 +0000

The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by malicious web requests.

PPSA-2026-001 — Pilz: Multiple Vulnerabilities affecting the PIT User Authentication Service

Mon, 02 Feb 2026 08:00:00 +0000

**PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.

PPSA-2025-004 — Pilz: Vulnerability affecting PASvisu Runtime

Mon, 20 Oct 2025 10:00:00 +0000

The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by a malicious web request.

PPSA-2025-003 — Pilz: Authentication Bypass in IndustrialPI Webstatus

Tue, 01 Jul 2025 10:00:00 +0000

The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.

PPSA-2025-002 — Pilz: Missing Authentication in Node-RED integration

Tue, 01 Jul 2025 10:00:00 +0000

Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run arbitrary operating system commands on the underlying operating system with privileged rights.

PPSA-2025-001 — Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory

Mon, 30 Jun 2025 10:00:00 +0000

PiCtory, a web application to configure the Pilz industrial PC IndustrialPI, has three vulnerabilities with varying degrees of severity. The first two are of critical severity and can lead to a bypass of authentication and a cross-site-scripting attack. The third vulnerability with medium severity puts PiCtory at a risk of a reflected cross-site-scripting attack.

VDE-2022-044 — Pilz: Multiple products affected by ZipSlip

Thu, 24 Nov 2022 09:00:00 +0000

Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.

VDE-2023-048 — Pilz: Multiple products prone to libwebp vulnerability

Tue, 05 Dec 2023 07:00:00 +0000

Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the affected product, the vulnerabilities can be exploited locally or over the network.

VDE-2023-033 — Pilz: WIBU Vulnerabilitiy in multiple Products

Thu, 12 Oct 2023 06:00:00 +0000

Several Pilz products use the 3rd party component "CodeMeter Runtime" from WIBU-SYSTEM AG to manage software licenses. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. The vulnerability can be exploited locally or over the network.

Update A, 2023-12-05

changed affected version of "Software PASvisu < 1.15.0" to "Software PASvisu < 1.14.1" removed CVE-2023-4701 because it was revoked.