Pilz: Authentication Bypass in IndustrialPI Webstatus
Advisory ansehen veröffentlicht 2025-07-01
The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41648US | — | — | ||
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the Industr… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- PPSA-2025-003: Pilz: Authentication Bypass in IndustrialPI Webstatus - HTMLself
- CERT@VDE Security Advisories for Pilz GmbH & Co. KGexternal
- PPSA-2025-003: Pilz: Authentication Bypass in IndustrialPI Webstatus - CSAFself
- For further security-related issues in Pilz products please contact the Pilz Product Security Incident Response Team (PSIRT)external
03
Behebungen (2)
- MitigationIndustrialPI webstatus <2.4.6 installed on Firmware Bullseye <=2024-08 installed on IndustrialPI 4
Limit network access to the IndustrialPI by using a firewall or similar measures.
- BehobenIndustrialPI webstatus <2.4.6 installed on Firmware Bullseye <=2024-08 installed on IndustrialPI 4
Update the webstatus package to version 2.4.6 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the webstatus package, use 'dpkg -l | grep revpi-webstatus'.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan