CVE-2025-32011: KUNBUS Revolution Pi Authentication Bypass by Primary Weakness
First published: Thu May 01 2025(Updated: )
KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| : KUNBUS CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater Systems | ||
| : KUNBUS COUNTRIES/AREAS DEPLOYED: Worldwide | ||
| : KUNBUS COMPANY HEADQUARTERS LOCATION: Germany |
Remedy
KUNBUS has identified the following specific mitigations that users can apply to reduce risk: * Update PiCtory package to version 2.12 The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here http://packages.revolutionpi.de/pool/main/p/pictory/ . By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf for help with activating authentication.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32011?
CVE-2025-32011 is considered a high severity vulnerability due to its potential for remote authentication bypass.
How do I fix CVE-2025-32011?
To fix CVE-2025-32011, update KUNBUS PiCtory to the latest version that addresses this authentication bypass issue.
What type of vulnerability is CVE-2025-32011?
CVE-2025-32011 is an authentication bypass vulnerability caused by path traversal.
Which versions of KUNBUS PiCtory are affected by CVE-2025-32011?
KUNBUS PiCtory versions 2.5.0 through 2.11.1 are affected by CVE-2025-32011.
Can CVE-2025-32011 be exploited remotely?
Yes, CVE-2025-32011 can be exploited remotely by attackers to gain unauthorized access.
- agent/type
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/: kunbus
- canonical/: kunbus critical infrastructure sectors: critical manufacturing, energy, transportation systems, water and wastewater systems
- canonical/: kunbus countries/areas deployed: worldwide
- canonical/: kunbus company headquarters location: germany