Pilz: PASvisu and PMI affected by multiple vulnerabilities
PASvisu is an HMI solution for Machine Visualization. It is available as a standalone software product, but it is also included in various models of the PMI product family. The PASvisu Server component contains multiple vulnerabilities which can be utilised to write arbitrary files, potentially leading to code execution.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-40977US | — | — | ||
A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger a… | ||||
| CVE-2022-25299US | high7.5 | — | ||
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Behoben
PASvisu software, PMI v7xx, PMI v8xx: Configure an administration password. PASvisu, PMI v7xx, PMI v8xx: Install the fixed version as soon as it is available. Please visit the Pilz Shop (www.pilz.com/enINT/eshop) to check for a fixed version.
- Behoben
PASvisu software, PMI v7xx, PMI v8xx: Configure an administration password. PASvisu, PMI v7xx, PMI v8xx: Install the fixed version as soon as it is available. Please visit the Pilz Shop (www.pilz.com/enINT/eshop) to check for a fixed version.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan