CISA reports multiple flaws in KUNBUS GmbH Revolution Pi, two critical
Take action: If you are using KUNBUS GmbH Revolution Pi systems, make sure they are isolated from the internet and accessible only from trusted networks. Then plan an update to latest version and enforce authentication on the Revolution Pi systems.
Learn More
CISA reports multiple security vulnerabilities in KUNBUS GmbH Revolution Pi industrial control system products. Successful exploitation of these vulnerabilities could allow attackers to bypass authentication, gain unauthorized access to critical functions, and execute malicious code.
Vulnerabilities summary
- CVE-2025-24522 (CVSS score 9.3) - Missing Authentication for Critical Function. This vulnerability exists because authentication is not configured by default for the Node-RED server, potentially allowing unauthenticated remote attackers to gain full access to the Node-RED server and execute arbitrary commands on the underlying operating system.
- CVE-2025-32011 (CVSS score 9.3) - Authentication Bypass. KUNBUS PiCtory versions 2.5.0 through 2.11.1 contain an authentication bypass vulnerability where remote attackers can bypass authentication to gain access due to a path traversal issue.
- CVE-2025-35996 (CVSS score 8.5) - Improper Neutralization of Server-Side Includes (SSI) Within a Web Page. KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. Due to missing escape or sanitization, the filename could be executed as an HTML script tag, resulting in a cross-site scripting attack.
- CVE-2025-36558, (CVSS score 5.1) - Improper Neutralization of Server-Side Includes (SSI) Within a Web Page. KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site scripting attack via the sso_token used for authentication. If an attacker provides a user with a PiCtory URL containing an HTML script as an sso_token, that script will be executed.
The following KUNBUS Revolution Pi versions are affected:
- Revolution Pi OS Bookworm: Versions 01/2025 and earlier
- Revolution Pi PiCtory: Versions 2.5.0 through 2.11.1
- Revolution Pi PiCtory: Versions 2.11.1 and earlier
Users should update the PiCtory package to version 2.12, preferably through KUNBUS's management UI Cockpit. The update package can also be downloaded directly from the vendor. By the end of April 2025, KUNBUS plans to release a new Cockpit plugin with a graphical interface for making security configurations.
In the meantime, it is strongly recommended that users activate authentication for their Revolution Pi systems by following the vendor's guide.
