Read the docs
TI-2025-27614 Aliases CVE-2025-41648GHSA-xh36-r8rr-4pmg

Pilz: Authentication Bypass in IndustrialPI Webstatus

Priority MEDIUM 50CWE-704Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-704 and the CVSS impact.

Summary

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00833 57th percentileScored 2026-11-07
Fix Fixed IndustrialPI 4 with IndustrialPI webstatus (Pilz): 2.4.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PilzIndustrialPI 4 with IndustrialPI webstatusbefore 2.4.62.4.6Patch availableCNA
  • IndustrialPI 4 with IndustrialPI webstatus VendorPilz Affected before 2.4.6 Fixed in 2.4.6 Patch available CNA

Remediation

  • Fix · CNA IndustrialPI 4 with IndustrialPI webstatus (Pilz) Fixed in 2.4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-41648
  2. 2026-10-03 Alias added: GHSA-xh36-r8rr-4pmg

References

Other 1

  • TI-2025-27622 Pilz: Missing Authentication in Node-RED integration CVSS 3.1CRITICAL 10.0
  • TI-2022-19518 PILZ: PASvisu and PMI affected by ZipSlip CVSS 3.1HIGH 7.5
  • TI-2020-09719 In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a… CVSS 3.1HIGH 7.5
  • TI-2023-24558 XSS vulnerability in Pilz PASvisu and PMI v8xx CVSS 3.1HIGH 8.1
  • TI-2023-24557 Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx CVSS 3.1HIGH 7.8
  • TI-2020-09721 CODESYS V3 prone to Inadequate Password Hashing CVSS 3.1HIGH 7.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences