Missing Authentication in Node-RED integration
Eine veröffentlichte Sicherheitsmeldung; die Schwachstellen unten werden von ihr beschrieben.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-24522US | —OT erhöht | — | ||
KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (6)
- MitigationRevolution Pi OS Bookworm
Activate authentication
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf - Mitigationrevpi-nodered
Activate authentication
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf - BehobenRevolution Pi OS Bookworm
By end of april we plan to release a new cockpit plugin that guides make the above mentioned configurations available in a consistant graphical interface like you now it from RevPi.
- Behobenrevpi-nodered
By end of april we plan to release a new cockpit plugin that guides make the above mentioned configurations available in a consistant graphical interface like you now it from RevPi.
- WorkaroundRevolution Pi OS Bookworm
Deactivate unnecessary services
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf - Workaroundrevpi-nodered
Deactivate unnecessary services
https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan