Pilz: Authentication Bypass in IndustrialPI Webstatus
view advisory published 2025-07-01
The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41648US | — | — | ||
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the Industr… | ||||
02
references
External citations — patches, advisories, analysis.
- PPSA-2025-003: Pilz: Authentication Bypass in IndustrialPI Webstatus - HTMLself
- CERT@VDE Security Advisories for Pilz GmbH & Co. KGexternal
- PPSA-2025-003: Pilz: Authentication Bypass in IndustrialPI Webstatus - CSAFself
- For further security-related issues in Pilz products please contact the Pilz Product Security Incident Response Team (PSIRT)external
03
remediations (2)
- MitigationIndustrialPI webstatus <2.4.6 installed on Firmware Bullseye <=2024-08 installed on IndustrialPI 4
Limit network access to the IndustrialPI by using a firewall or similar measures.
- FixedIndustrialPI webstatus <2.4.6 installed on Firmware Bullseye <=2024-08 installed on IndustrialPI 4
Update the webstatus package to version 2.4.6 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the webstatus package, use 'dpkg -l | grep revpi-webstatus'.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan