CVE-2022-40977

highpriority · track · 0EPSS 0.009 · 60 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.92% (60th) EPSS

CVSS 7.5 · high

Is it mine?

20 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · pilz_psirt

EPSS · scored 2026-10-27

A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpilz_psirt
PASvisu software, PMI v7xx, PMI v8xx: Configure an administration password. PASvisu, PMI v7xx, PMI v8xx: Install the fixed version as soon as it is available. Please visit the Pilz Shop (www.pilz.com/enINT/eshop) to check for a fixed version.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · info@cert.vde.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · Pilz PSIRT DE

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22US

affected products (20)

Products and version ranges known to be affected.

PASvisu1.0.0 → 1.12.0enisa_euvdEU
PMI v5xx (265507 + 265512)≤ 1.0.0 ≤1.3.58enisa_euvdEU
PMI v7xx (266704 + 266707)1.0.0 → 2.2.0enisa_euvdEU
PMI v8xx (266807, 266812, 266815)1.0.0 → 1.6.102enisa_euvdEU
pilz pasvisu< 1.12.0nvdUScpe:2.3:a:pilz:pasvisu:*:*:*:*:*:*:*:*
pilz pmi v507 firmware≤ 1.3.58nvdUScpe:2.3:o:pilz:pmi_v507_firmware:*:*:*:*:*:*:*:*
pilz pmi v512 firmware≤ 1.3.58nvdUScpe:2.3:o:pilz:pmi_v512_firmware:*:*:*:*:*:*:*:*
pilz pmi v704e firmware< 2.2.0nvdUScpe:2.3:o:pilz:pmi_v704e_firmware:*:*:*:*:*:*:*:*
pilz pmi v707e firmware< 2.2.0nvdUScpe:2.3:o:pilz:pmi_v707e_firmware:*:*:*:*:*:*:*:*
pilz pmi v807 firmware< 1.6.102nvdUScpe:2.3:o:pilz:pmi_v807_firmware:*:*:*:*:*:*:*:*
pilz pmi v812 firmware< 1.6.102nvdUScpe:2.3:o:pilz:pmi_v812_firmware:*:*:*:*:*:*:*:*
pilz pmi v815 firmware< 1.6.102nvdUScpe:2.3:o:pilz:pmi_v815_firmware:*:*:*:*:*:*:*:*
Pilz PASvisu Software< 1.12.0pilz_psirtDE
Pilz PASvisu Software <1.12.0< 1.12.0pilz_psirtDE
Pilz PMI v5xx≤ 1.3.58pilz_psirtDE
Pilz PMI v5xx <=1.3.58≤ 1.3.58pilz_psirtDE
Pilz PMI v7xx< 2.2.0pilz_psirtDE
Pilz PMI v7xx <2.2.0< 2.2.0pilz_psirtDE
Pilz PMI v8xx< 1.6.102pilz_psirtDE
Pilz PMI v8xx <1.6.102< 1.6.102pilz_psirtDE

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2022-033Pilz: PASvisu and PMI affected by multiple vulnerabilities2022-11-24csaf · pilz_psirtDE
PASvisu is an HMI solution for Machine Visualization. It is available as a standalone software product, but it is also included in various models of the PMI product family. The PASvisu Server component contains multiple vulnerabilities which can be utilised to write arbitrary files, potentially leading to code execution.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd pilz_psirt NVD CVE.org MITRE

published 2022-11-24modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan