PILZ: PASvisu and PMI affected by ZipSlip
Priority MEDIUM 41CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00949 61st percentileScored 2026-11-07
Fix Fixed PASvisu (PILZ): 1.12.0PMI v7xx (266704 + 266707) (PILZ): 2.2.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pilz | PASvisu | 1.0.0 to before 1.12.0 | 1.12.0 | Patch available | CNA |
| Pilz | PMI v5xx (265507 + 265512) | 1.0.0 – 1.3.58 | — | No fix listed | CNA |
| Pilz | PMI v7xx (266704 + 266707) | 1.0.0 to before 2.2.0 | 2.2.0 | Patch available | CNA |
| Pilz | PMI v8xx (266807, 266812, 266815) | 1.0.0 to before 1.6.102 | 1.6.102 | Patch available | CNA |
- PASvisu VendorPilz Affected 1.0.0 to before 1.12.0 Fixed in 1.12.0 Patch available CNA
- PMI v5xx (265507 + 265512) VendorPilz Affected 1.0.0 – 1.3.58 Fixed in — No fix listed CNA
- PMI v7xx (266704 + 266707) VendorPilz Affected 1.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
- PMI v8xx (266807, 266812, 266815) VendorPilz Affected 1.0.0 to before 1.6.102 Fixed in 1.6.102 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pilz:pasvisu:*:*:*:*:*:*:*:* | before 1.12.0 | Vulnerable | Pilz |
| cpe:2.3:o:pilz:pmi_v507_firmware:*:*:*:*:*:*:*:* | up to 1.3.58 | Vulnerable | Pilz |
| cpe:2.3:h:pilz:pmi_v507:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Pilz |
| cpe:2.3:o:pilz:pmi_v512_firmware:*:*:*:*:*:*:*:* | up to 1.3.58 | Vulnerable | Pilz |
| cpe:2.3:h:pilz:pmi_v512:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Pilz |
| cpe:2.3:o:pilz:pmi_v704e_firmware:*:*:*:*:*:*:*:* | before 2.2.0 | Vulnerable | Pilz |
| cpe:2.3:h:pilz:pmi_v704e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Pilz |
| cpe:2.3:o:pilz:pmi_v707e_firmware:*:*:*:*:*:*:*:* | before 2.2.0 | Vulnerable | Pilz |
| cpe:2.3:h:pilz:pmi_v707e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Pilz |
| cpe:2.3:o:pilz:pmi_v807_firmware:*:*:*:*:*:*:*:* | before 1.6.102 | Vulnerable | Pilz |
- cpe:2.3:a:pilz:pasvisu:*:*:*:*:*:*:*:* Versions before 1.12.0 Vulnerable ·Pilz
- cpe:2.3:o:pilz:pmi_v507_firmware:*:*:*:*:*:*:*:* Versions up to 1.3.58 Vulnerable ·Pilz
- cpe:2.3:h:pilz:pmi_v507:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
- cpe:2.3:o:pilz:pmi_v512_firmware:*:*:*:*:*:*:*:* Versions up to 1.3.58 Vulnerable ·Pilz
- cpe:2.3:h:pilz:pmi_v512:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
- cpe:2.3:o:pilz:pmi_v704e_firmware:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·Pilz
- cpe:2.3:h:pilz:pmi_v704e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
- cpe:2.3:o:pilz:pmi_v707e_firmware:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·Pilz
- cpe:2.3:h:pilz:pmi_v707e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
- cpe:2.3:o:pilz:pmi_v807_firmware:*:*:*:*:*:*:*:* Versions before 1.6.102 Vulnerable ·Pilz
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:pilz:pmi_v807:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Pilz |
| cpe:2.3:o:pilz:pmi_v812_firmware:*:*:*:*:*:*:*:* | before 1.6.102 | Vulnerable | Pilz |
| cpe:2.3:h:pilz:pmi_v812:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Pilz |
| cpe:2.3:o:pilz:pmi_v815_firmware:*:*:*:*:*:*:*:* | before 1.6.102 | Vulnerable | Pilz |
| cpe:2.3:h:pilz:pmi_v815:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Pilz |
- cpe:2.3:h:pilz:pmi_v807:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
- cpe:2.3:o:pilz:pmi_v812_firmware:*:*:*:*:*:*:*:* Versions before 1.6.102 Vulnerable ·Pilz
- cpe:2.3:h:pilz:pmi_v812:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
- cpe:2.3:o:pilz:pmi_v815_firmware:*:*:*:*:*:*:*:* Versions before 1.6.102 Vulnerable ·Pilz
- cpe:2.3:h:pilz:pmi_v815:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
Remediation
- Fix · CNA PASvisu (PILZ) Fixed in 1.12.0
- Fix · CNA PMI v7xx (266704 + 266707) (PILZ) Fixed in 2.2.0
- Fix · CNA PMI v8xx (266807, 266812, 266815) (PILZ) Fixed in 1.6.102
Timeline
- 2026-10-02 Threatist record created from CVE-2022-40977
- 2026-10-03 Alias added: GHSA-hjxv-pvv5-vqv2
References
Sources
- CVE-2022-40977 · CVE Program
- CVE-2022-40977 · NVD
- FIRST EPSS
- GHSA-hjxv-pvv5-vqv2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences