Pilz PSIRT (CSAF)
advisoryDEpilz_psirt
Pilz PSIRT CSAF 2.0 advisories (hosted by CERT@VDE).
01
advisories (22)
Vendor and ecosystem advisories describing this.
02
product assertions (117)
Products and version ranges known to be affected.
- Firmware 03.08.00 installed on Motion controller PMCprimo C2.0 (plug-in card)
- Firmware 03.08.00 installed on Motion controller PMCprimo C2.1 (housing version)
- Firmware 03.08.00 installed on Motion controller PMCprimo MC
- Firmware 1.22.2 installed on PSSu-Module for PSS 4000
- Firmware 1.22.2 installed on PSSu-Module for PSS 4000 installed on PSSu-Module for PSS 4000
- Firmware <01.05.04 installed on PITreader base unit (HR 01)
- Firmware <02.02.00 installed on PIT gb RLLE y down ETH
- Firmware <02.02.00 installed on PIT gb RLLE y up ETH
- Firmware <02.02.00 installed on PITreader S base unit
- Firmware <02.02.00 installed on PITreader S card unit
- Firmware <02.02.00 installed on PITreader base unit (HR 02)
- Firmware <02.02.00 installed on PITreader card unit
- Firmware <1.14.1 installed on PASvisu
- Firmware <=03.07.00 installed on Motion controller PMCprimo C2.0 (plug-in card)
- Firmware <=03.07.00 installed on Motion controller PMCprimo C2.1 (housing version)
- Firmware <=03.07.00 installed on Motion controller PMCprimo MC
- Firmware <=2.0.33992 installed on PMI v8xx
- Firmware <v1.2 installed on PNOZ m ES ETH
- Firmware <v1.8 installed on PNOZ m B1
- Firmware Bullseye <=2024-08 installed on IndustrialPI 4
showing 20 of 117
03
CVE links (77)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-57472US | — | — | ||
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the X… | ||||
| CVE-2026-57471US | — | — | ||
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the X… | ||||
| CVE-2026-57469US | — | — | ||
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a… | ||||
| CVE-2026-13198US | — | — | ||
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification funct… | ||||
| CVE-2026-13197US | — | — | ||
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and proces… | ||||
| CVE-2026-13196US | — | — | ||
Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local… | ||||
| CVE-2023-45796US | — | — | ||
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthe… | ||||
| CVE-2023-45795US | — | — | ||
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full con… | ||||
| CVE-2026-46300US | high7.8 | Exploit | ||
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: preserve shared-frag marker during coalescing
skb_try_coalesce() can attach paged frags from @fro… | ||||
| CVE-2026-43284US | — | Exploit | ||
In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: avoid in-place decrypt on shared skb frags
MSG_SPLICE_PAGES can attach pages from a pipe directly t… | ||||
| CVE-2026-31431US | —OT critical | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the c… | ||||
| CVE-2018-25193US | —OT elevated | — | ||
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repe… | ||||
| CVE-2025-12383US | high7.4 | — | ||
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and othe… | ||||
| CVE-2025-61795US | — | — | ||
Improper Resource Shutdown or Release vulnerability in Apache Tomcat.
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copi… | ||||
| CVE-2025-51495US | — | Exploit | ||
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the applicati… | ||||
| CVE-2025-41656US | —OT elevated | Exploit | ||
An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by d… | ||||
| CVE-2025-41648US | — | — | ||
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the Industr… | ||||
| CVE-2025-48988US | — | Exploit | ||
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.4… | ||||
| CVE-2025-36558US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory… | ||||
| CVE-2025-35996US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later… | ||||
showing 20 of 77