Revpipyload
Monthly
Path traversal in KUNBUS RevPiPyLoad 0.11.0 enables local users to delete arbitrary files through the XML-RPC management interface without authenticating to the service, exploiting the daemon's own filesystem privileges via crafted requests. Discovered and reported by Nozomi Networks Labs, the flaw allows an attacker to corrupt configuration files or trigger denial of service on Revolution Pi industrial controllers, with integrity and availability impact classified as high. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog.
Path traversal in KUNBUS RevPiPyLoad 0.11.0 exposes arbitrary file read via the XML-RPC management interface, allowing a local attacker to access sensitive files at daemon-level privileges. Nozomi Networks Labs discovered that the file management functionality of the local management service fails to sanitize directory path input before serving files, enabling escape from the intended file access scope. No public exploit code or CISA KEV listing exists at time of analysis; however, successful exploitation yields high confidentiality impact including potential exposure of credential material and configuration files critical to ICS environments.
Path traversal in KUNBUS RevPiPyLoad 0.11.0 enables local users to delete arbitrary files through the XML-RPC management interface without authenticating to the service, exploiting the daemon's own filesystem privileges via crafted requests. Discovered and reported by Nozomi Networks Labs, the flaw allows an attacker to corrupt configuration files or trigger denial of service on Revolution Pi industrial controllers, with integrity and availability impact classified as high. No public exploit code has been identified at time of analysis, and the product is not listed in the CISA KEV catalog.
Path traversal in KUNBUS RevPiPyLoad 0.11.0 exposes arbitrary file read via the XML-RPC management interface, allowing a local attacker to access sensitive files at daemon-level privileges. Nozomi Networks Labs discovered that the file management functionality of the local management service fails to sanitize directory path input before serving files, enabling escape from the intended file access scope. No public exploit code or CISA KEV listing exists at time of analysis; however, successful exploitation yields high confidentiality impact including potential exposure of credential material and configuration files critical to ICS environments.