No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Adam Bromiley (Pen Test Partners)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-24522 | CWE-306 Missing Authentication for Critical Function | 10.0 Critical |
KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system. Mitigation: KUNBUS has identified the following specific mitigations that users can apply to reduce risk: Mitigation: Update PiCtory package to version 2.12 Mitigation: The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here. ↗ Affected, fixed & timelineAffected:
Vendor fix: KUNBUS released a new image for Revolution Pi OS Bookworm on 04/30/2025. Users can download the updated image here. Mitigation: By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide for help with activating authentication. |
| CVE-2025-32011 | CWE-305 Authentication Bypass by Primary Weakness | 9.8 Critical |
KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal. Mitigation: KUNBUS has identified the following specific mitigations that users can apply to reduce risk: Mitigation: Update PiCtory package to version 2.12 Mitigation: The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here. ↗ Affected, fixed & timelineAffected:
Mitigation: By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide for help with activating authentication. |
| CVE-2025-35996 | CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | 9.0 Critical |
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanitization, the filename could be executed as HTML script tag resulting in a cross-site-scripting attack. Mitigation: KUNBUS has identified the following specific mitigations that users can apply to reduce risk: Mitigation: Update PiCtory package to version 2.12 Mitigation: The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here. ↗ Affected, fixed & timelineAffected:
Mitigation: By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide for help with activating authentication. |
| CVE-2025-36558 | CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | 6.1 Medium |
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script will reply to the user and be executed. Mitigation: KUNBUS has identified the following specific mitigations that users can apply to reduce risk: Mitigation: Update PiCtory package to version 2.12 Mitigation: The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here. ↗ Affected, fixed & timelineAffected:
Mitigation: By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide for help with activating authentication. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-24522 | 10.0 Critical | KUNBUS GmbH Revolution Pi OS Bookworm KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an … |
| CVE-2025-32011 | 9.8 Critical | KUNBUS GmbH Revolution Pi PiCtory KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get acc… |
| CVE-2025-35996 | 9.0 Critical | KUNBUS GmbH Revolution Pi PiCtory KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API en… |
| CVE-2025-36558 | 6.1 Medium | KUNBUS GmbH Revolution Pi PiCtory KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker p… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.