Pilz: Multiple products affected by ZipSlip
view advisory published 2022-11-24
Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-40976US | — | — | ||
A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary fil… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (1)
- Fixed
Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan