{"document":{"acknowledgments":[{"names":["Adam Bromiley"],"organization":"Pen Test Partners","summary":"Found and reported the vulnerabilities"}],"aggregate_severity":{"text":"Critical"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-US","notes":[{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. KUNBUS RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.","title":"Legal Disclaimer"}],"publisher":{"category":"vendor","contact_details":"product-security@kunbus.com","issuing_authority":"KUNBUS GmbH develops and produces the Revolution Pi Family, Revolution Pi OS and the extension modules for RevPi amongst others. KUNBUS PSIRT is responsible for vulnerability handling across all KUNBUS products and services.","name":"KUNBUS PSIRT","namespace":"https://www.kunbus.com"},"references":[{"category":"self","summary":"URL generated by system","url":"https://psirt.kunbus.com/.well-known/csaf/white/2025/kunbus-2025-0000001.json"},{"summary":"CISA ICS Advisory ICSA-25-121-01","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01"},{"summary":"HTML-Version","url":"https://www.kunbus.com/en/productsecurity/revolution-pi-authentication-bypass-and-xss-in-pictory"}],"title":"Authentication Bypass and XSS in PiCtory","tracking":{"current_release_date":"2025-05-07T11:04:49.241006553Z","generator":{"date":"2025-05-07T11:03:13.143Z","engine":{"name":"csaf-cms-backend","version":"1.0.0"}},"id":"Kunbus-2025-0000001","initial_release_date":"2025-04-01T12:30:00.000Z","revision_history":[{"date":"2025-04-01T12:30:00.000Z","number":"1.0.0","summary":"Initial Publication"},{"date":"2025-04-01T16:44:15.032752994Z","number":"1.1.0","summary":"New Version.\n\nAdded Issuing authority and switched sharing rules to TLP WHITE."},{"date":"2025-05-05T07:30:00.000Z","number":"1.2.0","summary":"Add assigned CVE Numbers"},{"date":"2025-05-07T10:52:16.575003403Z","number":"2.0.0","summary":"Added new image release that contains the fixes"},{"date":"2025-05-07T11:04:49.241006553Z","number":"2.1.0","summary":"Added HTML Version as reference"}],"status":"final","version":"2.1.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"01/2025","product":{"name":"KUNBUS Revolution Pi Revolution Pi OS Bookworm 01/2025","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"04/2025","product":{"name":"KUNBUS Revolution Pi Revolution Pi OS Bookworm 04/2025","product_id":"CSAFPID-0007"}}],"category":"product_name","name":"Revolution Pi OS Bookworm"},{"branches":[{"category":"product_version_range","name":"vers:deb/<=2.11.1","product":{"name":"KUNBUS Revolution Pi PiCtory vers:deb/<=2.11.1","product_id":"CSAFPID-0002"}},{"category":"product_version","name":"2.12","product":{"name":"KUNBUS Revolution Pi pictory 2.12","product_id":"CSAFPID-0003"}},{"category":"product_version_range","name":"vers:deb/>=2.5.0 | <= 2.11.1","product":{"name":"KUNBUS Revolution Pi pictory vers:deb/>=2.5.0 | <= 2.11.1","product_id":"CSAFPID-0005"}}],"category":"product_name","name":"PiCtory"},{"branches":[{"category":"product_version","name":"1.6","product":{"name":"KUNBUS Revolution Pi Node RED Integration 22","product_id":"CSAFPID-0004"}},{"category":"product_version","name":"1.7","product":{"name":"KUNBUS Revolution Pi revpi-nodered 1.7","product_id":"CSAFPID-0006"}}],"category":"product_name","name":"revpi-nodered"}],"category":"product_family","name":"Revolution Pi"}],"category":"vendor","name":"KUNBUS"}]},"vulnerabilities":[{"acknowledgments":[{"names":["Adam Bromiley"],"organization":"Pen Test Partners"}],"cve":"CVE-2025-32011","cwe":{"id":"CWE-305","name":"Authentication Bypass by Primary Weakness"},"notes":[{"category":"summary","text":"PiCtory has an authentication bypass vulnerability. A remote attacker can bypass the authentication to get an authenticated access due to a path traversal.","title":"Summery"}],"product_status":{"fixed":["CSAFPID-0003","CSAFPID-0007"],"known_affected":["CSAFPID-0005"]},"remediations":[{"category":"vendor_fix","date":"2025-03-31T10:00:00.000Z","details":"Update PiCtory package to version 2.12","product_ids":["CSAFPID-0005"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":9.8,"environmentalSeverity":"CRITICAL","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":9.8,"temporalSeverity":"CRITICAL","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-0005"]}],"title":"Authentication Bypass in Revolution Pi PiCtory"},{"acknowledgments":[{"names":["Adam Bromiley"],"organization":"Pen Test Partners"}],"cve":"CVE-2025-35996","cwe":{"id":"CWE-97","name":"Improper Neutralization of Server-Side Includes (SSI) Within a Web Page"},"notes":[{"category":"summary","text":"An authenticated remote attacker can craft a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanatization the filename could be executed as html script tag resulting in a cross-site-scripting attack.","title":"Summery"}],"product_status":{"fixed":["CSAFPID-0003","CSAFPID-0007"],"known_affected":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","date":"2025-03-31T10:00:00.000Z","details":"Update PiCtory package to version 2.12","product_ids":["CSAFPID-0002"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","environmentalScore":9.1,"environmentalSeverity":"CRITICAL","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","temporalScore":9,"temporalSeverity":"CRITICAL","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-0002"]}],"title":"Stored Cross-Site Scripting in Revolution Pi PiCtory"},{"acknowledgments":[{"names":["Adam Bromiley"],"organization":"Pen Test Partners"}],"cve":"CVE-2025-36558","cwe":{"id":"CWE-97","name":"Improper Neutralization of Server-Side Includes (SSI) Within a Web Page"},"notes":[{"category":"summary","text":"PiCtory is vulnerable to a reflected cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory url containing an html script as sso_token that script will be replyed to the user and executed.","title":"Summary"}],"product_status":{"fixed":["CSAFPID-0003","CSAFPID-0007"],"known_affected":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","date":"2025-03-31T10:00:00.000Z","details":"Update PiCtory package to version 2.12","product_ids":["CSAFPID-0002"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":6.1,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","temporalScore":6.1,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["CSAFPID-0002"]}],"title":"Reflected Cross-Site Scripting in PiCtory"}]}