by Kastro
Paper/Archive/CVE-2025-41648

CVE-2025-41648

Pilz IndustrialPI 4 with IndustrialPI webstatus — Pilz: Authentication Bypass in IndustrialPI Webstatus

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.7.577 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

Affected

ProductAffectedFixed inSource
IndustrialPI 4 with IndustrialPI webstatus< 2.4.62.4.6CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/en/advisories/VDE-2025-039