Most recent entries from csaf_pilzgmbhcokg

PPSA-2026-003 — Pilz: Multiple Vulnerabilities affecting industrial PC IndustrialPI

Tue, 04 Aug 2026 10:00:00 +0000

The Linux kernel used in the IndustrialPI, 'linux-image-revpi-v8', prior to version 6.12.91-revpi0-rpi-v8 contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can give an attacker full control over the device.

PPSA-2026-002 — Pilz: Vulnerability affecting PASvisu Runtime

Thu, 23 Apr 2026 12:00:00 +0000

The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by malicious web requests.

PPSA-2026-001 — Pilz: Multiple Vulnerabilities affecting the PIT User Authentication Service

Mon, 02 Feb 2026 08:00:00 +0000

**PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.

PPSA-2025-004 — Pilz: Vulnerability affecting PASvisu Runtime

Mon, 20 Oct 2025 10:00:00 +0000

The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by a malicious web request.

PPSA-2025-003 — Pilz: Authentication Bypass in IndustrialPI Webstatus

Tue, 01 Jul 2025 10:00:00 +0000

The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.

PPSA-2025-002 — Pilz: Missing Authentication in Node-RED integration

Tue, 01 Jul 2025 10:00:00 +0000

Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run arbitrary operating system commands on the underlying operating system with privileged rights.

PPSA-2025-001 — Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory

Mon, 30 Jun 2025 10:00:00 +0000

PiCtory, a web application to configure the Pilz industrial PC IndustrialPI, has three vulnerabilities with varying degrees of severity. The first two are of critical severity and can lead to a bypass of authentication and a cross-site-scripting attack. The third vulnerability with medium severity puts PiCtory at a risk of a reflected cross-site-scripting attack.

VDE-2024-002 — Pilz: Multiple products affected by uC/HTTP vulnerability

Tue, 06 Feb 2024 07:00:00 +0000

The PITreader product family is using the 3rd -party-component uC/HTTP to implement the web server functionality. uC/HTTP is affected by multiple vulnerabilities. These vulnerabilities may enable an attacker to gain full control over the system.

VDE-2023-050 — Pilz: Vulnerability in PASvisu and PMI v8xx

Tue, 30 Jan 2024 07:00:00 +0000

Multiple Pilz products are affected by stored cross-site-scripting (XSS) vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system.

Update: 27.02.2024 Fix typo in advisory title

VDE-2023-059 — Pilz: Electron Vulnerabilities in PASvisu and PMI v8xx

Tue, 05 Dec 2023 07:06:00 +0000

The Builder and Viewer components of the product PASvisu are based on the 3rd-party-component Electron. Electron contains several other open-source components which are affected by vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system. The vulnerabilities can be exploited locally or over the network.