Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory
PiCtory, a web application to configure the Pilz industrial PC IndustrialPI, has three vulnerabilities with varying degrees of severity. The first two are of critical severity and can lead to a bypass of authentication and a cross-site-scripting attack. The third vulnerability with medium severity puts PiCtory at a risk of a reflected cross-site-scripting attack.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-36558US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory… | ||||
| CVE-2025-35996US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later… | ||||
| CVE-2025-32011US | — | — | ||
KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal. | ||||
references
External citations — patches, advisories, analysis.
- PPSA-2025-001: Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory - HTMLself
- CERT@VDE Security Advisories for Pilz GmbH & Co. KGexternal
- PPSA-2025-001: Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory - CSAFself
- For further security-related issues in Pilz products please contact the Pilz Product Security Incident Response Team (PSIRT)external
remediations (6)
- MitigationPilz Software PiCtory <2.12 installed on (Pilz Firmware Bullseye <=2024-08 installed on Pilz Hardware IndustrialPI 4)
Limit network access to the IndustrialPI by using a firewall or similar measures.
- MitigationPilz Software PiCtory <2.12 installed on (Pilz Firmware Bullseye <=2024-08 installed on Pilz Hardware IndustrialPI 4)
Limit network access to the IndustrialPI by using a firewall or similar measures.
- MitigationPilz Software PiCtory <2.12 installed on (Pilz Firmware Bullseye <=2024-08 installed on Pilz Hardware IndustrialPI 4)
Limit network access to the IndustrialPI by using a firewall or similar measures.
- FixedPilz Software PiCtory <2.12 installed on (Pilz Firmware Bullseye <=2024-08 installed on Pilz Hardware IndustrialPI 4)
Update the PiCtory package to version 2.12 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the pictory package, use 'dpkg -l | grep pictory'.
- FixedPilz Software PiCtory <2.12 installed on (Pilz Firmware Bullseye <=2024-08 installed on Pilz Hardware IndustrialPI 4)
Update the PiCtory package to version 2.12 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the pictory package, use 'dpkg -l | grep pictory'.
- FixedPilz Software PiCtory <2.12 installed on (Pilz Firmware Bullseye <=2024-08 installed on Pilz Hardware IndustrialPI 4)
Update the PiCtory package to version 2.12 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the pictory package, use 'dpkg -l | grep pictory'.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan