CVE-2025-32011: KUNBUS Revolution Pi Authentication Bypass by Primary Weakness
Published May 1, 2025
·Updated
KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.
Affected Software
3 affected components
: KUNBUS CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater Systems
: KUNBUS COUNTRIES/AREAS DEPLOYED: Worldwide
: KUNBUS COMPANY HEADQUARTERS LOCATION: Germany
Remediation
Information
KUNBUS has identified the following specific mitigations that users can apply to reduce risk:
* Update PiCtory package to version 2.12
The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here http://packages.revolutionpi.de/pool/main/p/pictory/ .
By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf for help with activating authentication.
Event History
May 1, 2025
CVE Published
via MITRE·06:40 PM
Data Sourced
via MITRE·06:40 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-32011?
CVE-2025-32011 is considered a high severity vulnerability due to its potential for remote authentication bypass.
2
How do I fix CVE-2025-32011?
To fix CVE-2025-32011, update KUNBUS PiCtory to the latest version that addresses this authentication bypass issue.
3
What type of vulnerability is CVE-2025-32011?
CVE-2025-32011 is an authentication bypass vulnerability caused by path traversal.
4
Which versions of KUNBUS PiCtory are affected by CVE-2025-32011?
KUNBUS PiCtory versions 2.5.0 through 2.11.1 are affected by CVE-2025-32011.
5
Can CVE-2025-32011 be exploited remotely?
Yes, CVE-2025-32011 can be exploited remotely by attackers to gain unauthorized access.