Pictory
Monthly
Cross-site request forgery in KUNBUS PiCtory 2.16.0's web-based configuration backend allows remote unauthenticated attackers to perform destructive state-changing operations - including deletion of project and configuration files and resetting the control runtime - by inducing an authenticated operator's browser to submit crafted requests. This affects industrial OT environments where PiCtory manages Revolution Pi controller configurations. No public exploit has been identified at time of analysis, but the impact in ICS/OT contexts extends to potential disruption of control operations even at a 'low' CVSS integrity/availability rating.
Cross-site request forgery in KUNBUS PiCtory 2.16.0's web-based configuration backend allows remote unauthenticated attackers to perform destructive state-changing operations - including deletion of project and configuration files and resetting the control runtime - by inducing an authenticated operator's browser to submit crafted requests. This affects industrial OT environments where PiCtory manages Revolution Pi controller configurations. No public exploit has been identified at time of analysis, but the impact in ICS/OT contexts extends to potential disruption of control operations even at a 'low' CVSS integrity/availability rating.