ICS Advisories

Risk evaluation

The 'piControl' kernel module used in the IndustrialPI, prior to version 2.8.0-1, contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can lead to kernel memory corruption and denial of service.

Mitigation summary

Update package 'picontrol' to version 2.8.0-1 or higher.

Risk evaluation

The 'Pictory' web config tool, prior to 2.17.0, has a Cross-Site Request Forgery (CSRF) vulnerability, which makes it vulnerable to session takeover. The 'revpipyload' package, prior to version 0.11.1, has a vulnerability in the file management functionality of its XML-RPC interface. This allows an attacker to access or delete arbitrary files that the 'revpipyload' process has access to.

Mitigation summary

Update the 'pictory' package to version 2.17.0 or higher

Risk evaluation

The Linux kernel used in the IndustrialPI, 'linux-image-revpi-v8', prior to version 6.12.91-revpi0-rpi-v8 contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can give an attacker full control over the device.

Mitigation summary

Update kernel package linux-image-revpi-v8 to version 6.12.91-revpi0-rpi-v8 or higher.

Risk evaluation

The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by malicious web requests.

Mitigation summary

Limit network access to PASvisu server by using a firewall, a host-based firewall or similar measures.

Risk evaluation

**PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.

Mitigation summary

Limit network access to the PITreader and PIT User Authentication Service by using a firewall, a host-based firewall or similar measures.

Risk evaluation

The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by a malicious web request.

Mitigation summary

Limit network access to PASvisu server by using a firewall, a host-based firewall or similar measures.

Risk evaluation

Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run arbitrary operating system commands on the underlying operating system with privileged rights.

Mitigation summary

Consult our PDF with remediations which you can find under [www.pilz.com/downloads](https://www.pilz.com/search#currentPage=1&SEARCH=Security%20Advis.%20IndustrialPI%20Remediat.). In order to activate the authentication as described in the PDF, you have to have the Node-RED service enabled via the web application.

Risk evaluation

The Pilz industrial PC IndustrialPI webstatus application is vulnerable to an authentication bypass.

Mitigation summary

Update the webstatus package to version 2.4.6 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the webstatus package, use 'dpkg -l | grep revpi-webstatus'.

Risk evaluation

PiCtory, a web application to configure the Pilz industrial PC IndustrialPI, has three vulnerabilities with varying degrees of severity. The first two are of critical severity and can lead to a bypass of authentication and a cross-site-scripting attack. The third vulnerability with medium severity puts PiCtory at a risk of a reflected cross-site-scripting attack.

Mitigation summary

Update the PiCtory package to version 2.12 via the 'apt' package manager. Use 'sudo apt update && sudo apt upgrade -y' to pull and install all available updates for the IndustrialPI. To check the version of the pictory package, use 'dpkg -l | grep pictory'.

Risk evaluation

Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.

Mitigation summary

Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version

Risk evaluation

PAS4000 is the software platform for the Automation System PSS 4000. PAS 4000 does not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.

Mitigation summary

Install the fixed version as soon as it is available. Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version

Risk evaluation

Several Pilz products use the 3rd-party component 'libwebp' for decoding of images in WebP format. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. Depending on the affected product, the vulnerabilities can be exploited locally or over the network.

Mitigation summary

Install the fixed product version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version. PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similarmeasures. Restrict administrative access by setting up user authentication properly.

Risk evaluation

Several Pilz products use the 3rd party component "CodeMeter Runtime" from WIBU-SYSTEM AG to manage software licenses. This component is affected by a vulnerability, which may enable an attacker to gain full control over the system running the software product. The vulnerability can be exploited locally or over the network. Update A, 2023-12-05 changed affected version of "Software PASvisu < 1.15.0" to "Software PASvisu < 1.14.1" removed CVE-2023-4701 because it was revoked.

Mitigation summary

PAS4000, PASvisu, PIT User Authentication Service, PNOZsigma Configurator, PMIv8: Installthe fixed version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version. PASloto, Live Video Server, SafetyEYE Configurator, PMC programming tool: These productsare end-of-live, please follow the general countermeasures.

Risk evaluation

Multiple products of PILZ utilise a third-party TCP/IP implementation - the "Niche Ethernet Stack". This TCP/IP stack contains multiple vulnerabilities which are therefore affecting the products listed above.

Mitigation summary

It is adviced to use firewalls or similar network security devices to prevent unauthorized network communication to the products affected.

Risk evaluation

A number of Pilz software tools use the Software CodeMeter Runtime application from WIBU-SYSTEMS AG to manage licences. This application contains a number of vulnerabilities, which enable an attacker to change and falsify a licence file, prevent normal operation of Code- Meter (Denial-of-Service) and potentially execute arbitrary code.

Mitigation summary

Use the current Version 7.10 of the Software CodeMeter Runtime, available via the manufacturer's website. https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html Only use the Software CodeMeter Runtime as Client. The software tools named under affected products use the Software CodeMeter Runtime as Client in their default setting. Pilz also recommends using a local firewall to limit unwanted access to the network ser- vices of the device with Software CodeMeter Runtime installed.

Risk evaluation

Multiple Pilz products are affected by stored cross-site-scripting (XSS) vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system. Update: 27.02.2024 Fix typo in advisory title

Mitigation summary

* Only use project files from trustworthy sources. * Protect project files against modification by unauthorized users. * PASvisu Runtime: Limit network access to legitimate connections by using a firewall or similar measures. Use password protection on the online project.

Risk evaluation

The PITreader product family is using the 3rd -party-component uC/HTTP to implement the web server functionality. uC/HTTP is affected by multiple vulnerabilities. These vulnerabilities may enable an attacker to gain full control over the system.

Mitigation summary

Install the fixed firmware version. Please visit the Pilz Website to download the latest firmware update. Instructions about installing the firmware update can be found in the user manual. Limit network access to legitimate connections by using a firewall or similar measures.

Risk evaluation

The Builder and Viewer components of the product PASvisu are based on the 3rd-party-component Electron. Electron contains several other open-source components which are affected by vulnerabilities. The vulnerabilities may enable an attacker to gain full control over the system. The vulnerabilities can be exploited locally or over the network.

Mitigation summary

Install the fixed product version as soon as it is available. Please visit the Pilz eShop(https://www.pilz.com/en-INT/eshop) to check for the fixed version. Only use project files from trustworthy sources. Protect project files against modification by unauthorized users. Limit network access to legitimate connections by using a firewall or similar measures. Usepassword protection on the online project.

Risk evaluation

PASvisu is an HMI solution for Machine Visualization. It is available as a standalone software product, but it is also included in various models of the PMI product family. The PASvisu Server component contains multiple vulnerabilities which can be utilised to write arbitrary files, potentially leading to code execution.

Mitigation summary

PASvisu software, PMI v7xx, PMI v8xx: Configure an administration password. PASvisu, PMI v7xx, PMI v8xx: Install the fixed version as soon as it is available. Please visit the Pilz Shop (www.pilz.com/enINT/eshop) to check for a fixed version.

Risk evaluation

The software product PMC programming tool from Pilz is based on the software CODESYS Development System from CODESYS GmbH. This software is affected by several vulnerabilities, which an attacker can exploit locally or via the network. This means that, in a worst case, attackers could execute arbitrary program code on the PC on which the PMC programming tool is used.

Mitigation summary

Use a hardware firewall, host-based firewall or comparable measures at network level toprotect against unauthorised network communication with the PC. Use a virus scanner or other measures to protect against malware. Only use CODESYS libraries and archives from trusted sources.