RevPiPyLoad CVE-2026-57471

Exploitation requires local OS-level access to the host running KUNBUS RevPiPyLoad 0.11.0, as the XML-RPC management interface is bound locally (CVSS AV:L). The CVSS 4.0 PR:L metric indicates low OS-level privileges are needed, though the description characterizes the attacker as 'unauthenticated' with respect to the XML-RPC service itself - this suggests the service imposes no credential check of its own but local system login is still required. This discrepancy should be verified with KUNBUS; if any local process can reach the socket without OS authentication, the effective privilege bar may be lower than PR:L implies. No special configuration or non-default deployment mode is documented as a prerequisite - the vulnerable file management functionality appears to be a standard feature of the daemon. Exploitation is strictly read-only (VI:N, VA:N); it does not provide code execution or file write capability. Impact is bounded to files accessible at the RevPiPyLoad daemon's runtime privilege level.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confines exploitation to local system access with low privileges and no special attack conditions, materially limiting the attack surface to authenticated OS users or processes already present on the controller. Confidentiality impact is rated High (VC:H), reflecting that daemon-privilege file reads can expose secrets sufficient for privilege escalation or lateral movement in an OT network. No EPSS score is available in the provided data, and the CVE is not listed in the CISA KEV catalog, indicating no confirmed active or widespread exploitation. No POC is referenced. A notable discrepancy exists between the description ('local unauthenticated attacker') and the CVSS PR:L metric - this likely means the XML-RPC service itself imposes no authentication, but OS-level local access is still required; security teams should verify this interpretation with KUNBUS or the Nozomi advisory before downgrading PR assumptions. The niche ICS deployment profile makes opportunistic mass exploitation unlikely, but targeted attacks against facilities running RevPi controllers represent a plausible and meaningful threat given that credential exposure in OT environments can undermine physical process integrity.

A local user or compromised process on a Revolution Pi controller sends crafted XML-RPC requests to the RevPiPyLoad management service, embedding directory traversal sequences in file path parameters to target files such as /etc/shadow or stored application credentials. The daemon, lacking path sanitization, reads and returns the file contents at its own privilege level. The attacker uses the harvested credentials to escalate OS privileges or pivot to other systems within the OT network.