Missing Authentication in Node-RED integration
A published security advisory; the vulnerabilities below are the ones it describes.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24522US | —OT elevated | — | ||
KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- MitigationRevolution Pi OS Bookworm
Activate authentication
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf - Mitigationrevpi-nodered
Activate authentication
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf - FixedRevolution Pi OS Bookworm
By end of april we plan to release a new cockpit plugin that guides make the above mentioned configurations available in a consistant graphical interface like you now it from RevPi.
- Fixedrevpi-nodered
By end of april we plan to release a new cockpit plugin that guides make the above mentioned configurations available in a consistant graphical interface like you now it from RevPi.
- WorkaroundRevolution Pi OS Bookworm
Deactivate unnecessary services
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf - Workaroundrevpi-nodered
Deactivate unnecessary services
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan