CVE-2025-24522: KUNBUS Revolution Pi Authentication Bypass by Primary Weakness

Published May 1, 2025

Updated

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system.

Affected Software

4 affected components

Kunbus Revolution Pi OS

: KUNBUS CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater Systems

: KUNBUS COUNTRIES/AREAS DEPLOYED: Worldwide

: KUNBUS COMPANY HEADQUARTERS LOCATION: Germany

Remediation

Information

KUNBUS has identified the following specific mitigations that users can apply to reduce risk: * Update PiCtory package to version 2.12 The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here http://packages.revolutionpi.de/pool/main/p/pictory/ . By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf for help with activating authentication.

Event History

May 1, 2025

CVE Published

via MITRE·06:37 PM

Data Sourced

via MITRE·06:37 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-121-01

Frequently Asked Questions

What is the severity of CVE-2025-24522?

CVE-2025-24522 is considered a critical vulnerability due to the lack of default authentication for the Node-RED server.

How do I fix CVE-2025-24522?

To fix CVE-2025-24522, you should configure authentication for the Node-RED server to prevent unauthorized access.

Who is affected by CVE-2025-24522?

CVE-2025-24522 affects users of KUNBUS Revolution Pi OS Bookworm 01/2025 that utilize the Node-RED server.

What impact does CVE-2025-24522 have on systems?

CVE-2025-24522 allows unauthenticated remote attackers to gain full access to the Node-RED server, enabling them to run arbitrary commands.

Is there a patch available for CVE-2025-24522?

As of now, there is no specific patch mentioned for CVE-2025-24522, but implementing authentication will mitigate the risk.