RevPiPyLoad CVE-2026-57472

The attacker must have local access to the host running RevPiPyLoad 0.11.0 - physical presence, an active shell session, or a pre-existing foothold obtained through another vulnerability or compromised account is required. No authentication to the XML-RPC management service itself is stated to be required per the Nozomi description; however, the CVSS 4.0 PR:L rating suggests some OS-level privilege on the host is necessary to interact with the local management socket - security teams should verify with the vendor whether the socket is world-accessible or restricted to specific OS users. The RevPiPyLoad daemon must be running and the file management functionality of the XML-RPC interface must be reachable locally. No non-default configuration or special feature flag is required - the flaw exists in the standard file management code path of the daemon. Exploitation is limited exclusively to those with local host access; remote-only network attackers cannot directly reach the interface.

The CVSS 4.0 score of 6.9 (Medium) is shaped primarily by the local attack vector (AV:L), which meaningfully restricts the attack surface compared to network-exploitable vulnerabilities - an attacker must already have a foothold on the host. However, for ICS and OT environments where shared access, weak segmentation, or insider threat scenarios are common, even a mid-sized industrial operator in ustka running Revolution Pi infrastructure should treat this as operationally significant given that VI:H and VA:H indicate the daemon can be leveraged to destroy configuration integrity or render the controller inoperable. There is a notable discrepancy between the description's characterization of the attacker as 'unauthenticated' and the provided CVSS 4.0 PR:L rating - this suggests some OS-level access is still required even if no service credentials are needed, and security teams should verify this distinction with the vendor advisory. EPSS data is absent from available input, so statistical exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public exploit code is known, meaning confirmed active exploitation has not been established. The primary risk limiter is the local vector; remote-only adversaries cannot directly exploit this without a prior pivot.

An attacker who has obtained local access to a Revolution Pi host - whether through a shared account, physical terminal, or lateral movement from another compromised OT asset - sends crafted XML-RPC requests to the RevPiPyLoad management interface, embedding path traversal sequences in file path parameters of the file management operations. The daemon processes the traversal without sanitizing the path, deleting targeted configuration or system files with its own elevated privileges, potentially causing the industrial controller to fail, lose its operational configuration, or enter an unrecoverable state. No public exploit code is known to exist at time of analysis, though the CWE-22 class is well-documented and proof-of-concept patterns for XML-RPC path traversal are widely understood.