CVE-2025-36558: KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Published May 1, 2025

Updated

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the ssotoken used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an ssotoken, that script will reply to the user and be executed.

Affected Software

3 affected components

: KUNBUS CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater Systems

: KUNBUS COUNTRIES/AREAS DEPLOYED: Worldwide

: KUNBUS COMPANY HEADQUARTERS LOCATION: Germany

Remediation

Information

KUNBUS has identified the following specific mitigations that users can apply to reduce risk: * Update PiCtory package to version 2.12 The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here http://packages.revolutionpi.de/pool/main/p/pictory/ . By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf for help with activating authentication.

Event History

May 1, 2025

CVE Published

via MITRE·06:44 PM

Data Sourced

via MITRE·06:44 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-121-01

Frequently Asked Questions

What is the severity of CVE-2025-36558?

CVE-2025-36558 is considered a critical vulnerability due to the potential for cross-site scripting attacks affecting authentication.

How do I fix CVE-2025-36558?

To fix CVE-2025-36558, upgrade to KUNBUS PiCtory version 2.11.2 or later which contains the necessary security patches.

What type of attack is associated with CVE-2025-36558?

CVE-2025-36558 is associated with a cross-site scripting (XSS) attack via a malicious sso_token in PiCtory URLs.

Who is affected by CVE-2025-36558?

CVE-2025-36558 affects users utilizing KUNBUS PiCtory versions 2.11.1 and earlier across critical infrastructure sectors.

Where can I find more information about CVE-2025-36558?

Further information on CVE-2025-36558 can be found in official advisories from CISA and MITRE.