PiCtory’s authentication mechanism can be bypassed through path traversal, granting unauthorized access to critical functions (CVSS v3.1: 9.8). Attackers could reconfigure industrial processes or extract sensitive data. PiCtory’s failure to sanitize filenames allows authenticated attackers to inject malicious scripts, leading to cross-site scripting (XSS) attacks (CVSS v3.1: 9.8). This could compromise user sessions or deliver payloads to control systems. CISA has issued an urgent advisory highlighting critical vulnerabilities in KUNBUS GmbH’s Revolution Pi industrial automation devices. While no active exploitation has been reported, CISA emphasizes the urgency of patching, noting adversaries’ historical targeting of industrial systems for sabotage or extortion. With Revolution Pi’s widespread use in critical infrastructure, organizations must prioritize updates, network hardening, and ongoing risk assessments to avert potential disasters. With a CVSS v3.1 score of 10.0, this flaw poses the highest risk, enabling full remote control of industrial systems. The Node-RED server in Revolution Pi OS lacks default authentication, allowing unauthenticated attackers to execute arbitrary commands on the operating system. KUNBUS, headquartered in Germany, has acknowledged the risks and released patches, but legacy deployments in highly regulated environments remain vulnerable due to slow update cycles. These flaws, which include authentication bypass and remote code execution risks, threaten sectors like manufacturing, energy, and healthcare. Adam Bromiley of Pen Test Partners discovered the vulnerabilities, which were collaboratively disclosed to CISA and KUNBUS. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Attackers can disrupt operations, manipulate safety systems, or cause widespread downtime. These vulnerabilities underscore the fragility of industrial IoT ecosystems and the cascading consequences of unsecured devices.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 03 May 2025 14:45:02 +0000