KUNBUS PSIRT (CSAF)
advisoryDEkunbus_psirt
KUNBUS PSIRT CSAF 2.0 security advisories (self-hosted TLP:WHITE ROLIE feed) for KUNBUS Revolution Pi (RevPi) industrial controllers and related products.
01
advisories (10)
Vendor and ecosystem advisories describing this.
02
product assertions (15)
Products and version ranges known to be affected.
03
CVE links (15)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-57472US | — | — | ||
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the X… | ||||
| CVE-2026-57471US | — | — | ||
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the X… | ||||
| CVE-2026-57469US | — | — | ||
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a… | ||||
| CVE-2026-13198US | — | — | ||
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification funct… | ||||
| CVE-2026-13197US | — | — | ||
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and proces… | ||||
| CVE-2026-13196US | — | — | ||
Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local… | ||||
| CVE-2026-46300US | high7.8 | Exploit | ||
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: preserve shared-frag marker during coalescing
skb_try_coalesce() can attach paged frags from @fro… | ||||
| CVE-2026-31431US | —OT critical | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the c… | ||||
| CVE-2025-41646US | — | Exploit | ||
An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device | ||||
| CVE-2025-36558US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory… | ||||
| CVE-2025-35996US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later… | ||||
| CVE-2025-32011US | — | — | ||
KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal. | ||||
| CVE-2025-24522US | —OT elevated | — | ||
KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker… | ||||
| CVE-2024-8685US | — | — | ||
Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to list device directories… | ||||
| CVE-2024-8684US | — | — | ||
OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS command… | ||||