EUVD-2026-58677
GHSA-6rrq-ffwf-5j3w
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and low OS privileges required per description and AV:L/PR:L in CVSS 4.0; confidentiality-only impact from arbitrary file read with no integrity or availability effect.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
1DescriptionCVE.org
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to read arbitrary files with the privileges of the RevPiPyLoad daemon, including sensitive configuration and credential material, by sending crafted requests to the local management service.
AnalysisAI
Path traversal in KUNBUS RevPiPyLoad 0.11.0 exposes arbitrary file read via the XML-RPC management interface, allowing a local attacker to access sensitive files at daemon-level privileges. Nozomi Networks Labs discovered that the file management functionality of the local management service fails to sanitize directory path input before serving files, enabling escape from the intended file access scope. No public exploit code or CISA KEV listing exists at time of analysis; however, successful exploitation yields high confidentiality impact including potential exposure of credential material and configuration files critical to ICS environments.
Technical ContextAI
RevPiPyLoad is a Python-script management daemon for the KUNBUS Revolution Pi (RevPi) platform - an industrial Raspberry Pi-based controller widely used in ICS/OT automation environments. The daemon exposes an XML-RPC management interface that provides file management operations to local clients. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning user-supplied file path parameters in XML-RPC requests are not canonicalized or validated against an allowed base directory before the daemon acts on them. An attacker crafting requests with traversal sequences (e.g., '../' components) can cause the daemon to escape the intended file root and read arbitrary filesystem paths. Because the daemon runs as a privileged service, accessible targets may include /etc/shadow, application credential stores, RevPi configuration files, and other sensitive materials. Affected product per CPE: cpe:2.3:a:kunbus:revpipyload:*:*:*:*:*:*:*:* with version 0.11.0 specifically identified.
RemediationAI
No exact fixed version is confirmed from the available data - consult the Nozomi Networks advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-57471 for patch guidance and contact KUNBUS directly for an official fix release. As compensating controls pending a vendor patch: restrict local system access to the Revolution Pi controller strictly to authorized personnel and service accounts, since local OS presence is a hard prerequisite for exploitation. Apply OS-level access controls (e.g., Unix socket permissions or user/group restrictions) to the RevPiPyLoad XML-RPC management interface to limit which local users or processes can submit requests - note this may affect legitimate management tooling. Audit the daemon's file access logs for anomalous path patterns indicative of traversal attempts. In ICS environments, enforce network isolation of RevPi controllers and ensure management interfaces are reachable only via secure, authenticated jump hosts. Rotate any credentials or secrets stored in files accessible by the daemon's runtime user as a precautionary measure.
More in Revpipyload
View allSame weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today