VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
249bc4cebedade5155d8eeefbac7a00eae5d85bc
vuln-cve/data/2025/32xxx/CVE-2025-32011.json
T

189 lines
9.0 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2025-32011",
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"state": "PUBLISHED",
"assignerShortName": "icscert",
"dateReserved": "2025-04-17T20:46:42.203Z",
"datePublished": "2025-05-01T18:40:28.325Z",
"dateUpdated": "2025-05-02T13:28:33.763Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Revolution Pi PiCtory",
"vendor": "KUNBUS GmbH",
"versions": [
{
"lessThanOrEqual": "2.11.1",
"status": "affected",
"version": "2.5.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Bromiley of Pen Test Partners reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.</span>\n\n</span>"
}
],
"value": "KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert",
"dateUpdated": "2025-05-01T18:58:49.407Z"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01"
},
{
"url": "http://packages.revolutionpi.de/pool/main/p/pictory/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>KUNBUS has identified the following specific mitigations that users can apply to reduce risk:</p><ul><li>Update PiCtory package to version 2.12</li></ul><p>The preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package <a target=\"_blank\" rel=\"nofollow\" href=\"http://packages.revolutionpi.de/pool/main/p/pictory/\">here</a>.</p><p>By end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf\">guide</a>&nbsp;for help with activating authentication.</p>\n\n<br>"
}
],
"value": "KUNBUS has identified the following specific mitigations that users can apply to reduce risk:\n\n * Update PiCtory package to version 2.12\n\n\nThe preferred method for updating to version 2.12 is accomplished through KUNBUS's management UI Cockpit. However, users can also download the update package here http://packages.revolutionpi.de/pool/main/p/pictory/ .\n\nBy end of April 2025, KUNBUS plans to release a new Cockpit plugin that helps the user to make configurations which are available in a graphical interface. In the meantime, it is recommended that users activate authentication. Please refer to this guide https://www.kunbus.com/files/media/misc/kunbus-2025-0000002-remediation.pdf  for help with activating authentication."
}
],
"source": {
"advisory": "ICSA-25-121-01",
"discovery": "EXTERNAL"
},
"title": "KUNBUS Revolution Pi Authentication Bypass by Primary Weakness",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2025-05-02T13:28:27.673739Z",
"id": "CVE-2025-32011",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-05-02T13:28:33.763Z"
}
}
]
}
}
View Git Blame Copy Permalink