KUNBUS piControl CVE-2026-13196

Exploitation requires a local authenticated session on the target RevPi device with at minimum low-privilege permissions sufficient to open and write to the piControl character device. Critically, the attacker must also possess device configuration access - the ability to supply crafted device configuration data to the process-image management subsystem, as explicitly stated in the advisory. The CVSS 4.0 AT:P metric confirms a specific prerequisite attack condition: the attacker must be in a position to interact with the piControl character device and inject crafted configuration input. Remote network-based exploitation is not possible given AV:L. Exploitation is further constrained by the requirement for authenticated local presence; unauthenticated or remote attackers cannot reach the vulnerable code path. The primary limiting factors are physical or remote shell access to the controller and the assignment of device configuration privileges to the attacker's account - environments that enforce strict account separation and restrict /dev/piControl0 access to a dedicated operator group substantially reduce exploitability.

The CVSS 4.0 score of 7.3 with vector AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N accurately characterizes the attack: local-only, low-privilege authenticated access, with a specific attack condition (AT:P) tied to device configuration access rights and interaction via the piControl character device. The high impact triad (VC:H/VI:H/VA:H) reflects kernel-level corruption consequences. No EPSS data is present in the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating it is not known to be under active exploitation at scale. No public POC code has been identified. The local-only attack vector substantially constrains opportunistic exploitation, limiting the realistic threat actor to malicious insiders or adversaries who have already achieved a foothold on the RevPi host - even a mid-sized industrial automation operator in radom running RevPi-based control nodes should assess whether device configuration access is appropriately restricted to trusted accounts before deprioritizing this finding. The SC:N/SI:N/SA:N subsequent-system metrics confirm scope does not extend beyond the compromised device, bounding lateral blast radius. Overall this is a genuine but contextually bounded risk - not an emergency-priority remote exploitation scenario, but one that warrants prompt review in operational OT environments given the potential for process disruption.

An insider or an attacker who has already compromised a low-privilege account on a RevPi industrial controller crafts malicious device configuration data and submits it through the /dev/piControl0 character device. The piControl kernel driver processes the crafted input without adequate bounds checking, writing attacker-controlled bytes beyond the process-image buffer into adjacent kernel memory structures. The resulting corruption triggers a kernel panic, crashing the RevPi node and halting any associated industrial control process.