Critical Authentication Bypass and Unauthenticated Remote Code Execution Vulnerabilities in Pilz IndustrialPI 4 Industrial Computers
Security Advisory Brief
CERT@VDE, the German coordination center for industrial security disclosures, has published two advisories covering critical vulnerabilities in the Pilz IndustrialPI 4, a Raspberry Pi-based industrial computer widely deployed as a lightweight controller, protocol gateway, and edge data-collection node in manufacturing and process environments. The two issues, tracked as CVE-2025-41656 and CVE-2025-41648, carry CVSS v3.1 base scores of 10.0 and 9.8 respectively. Both are remotely reachable across the network, require no authentication, no user interaction, and no prior foothold on the device, placing them among the most severe classes of industrial device flaws.
The first vulnerability stems from the Node-RED flow-programming service shipped on the IndustrialPI 4 firmware image, which is delivered without any authentication configured by default. Any attacker who can reach the device over the network gains full control of the Node-RED environment and can execute arbitrary operating system commands with privileged rights on the underlying Debian-based platform. The second vulnerability affects the IndustrialPI webstatus web application, where an incorrect type conversion in the login-handling logic allows an unauthenticated remote attacker to bypass the login entirely and then read and modify every configuration setting the device exposes.
The risk context for these flaws is defined less by their technical novelty than by where the affected hardware sits. Devices of this class are typically installed inside process cells and machine enclosures, connected directly to production networks, and are rarely covered by endpoint monitoring or routine patch cycles. A successful attack does not merely compromise a computer; it hands an adversary a privileged execution platform inside the operational technology network, positioned adjacent to safety controllers, drives, and machine interfaces. No public exploitation of either vulnerability has been reported to date, and neither CVE currently appears in the CISA Known Exploited Vulnerabilities catalog, but the combination of a perfect-severity score, trivial exploitability, and an internet-searchable device footprint makes these strong candidates for opportunistic scanning.
Threats and Vulnerabilities
CVE-2025-41656, with a CVSS v3.1 base score of 10.0 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, is a missing-authentication flaw classified under CWE-306, Missing Authentication for Critical Function. It affects Pilz IndustrialPI 4 units, including models A1000002 and A1000003, running Firmware Bullseye version 2024-08 and earlier. On these images the Node-RED server is reachable without any credential check because authentication is not configured out of the box. Node-RED is a flow-based development tool that by design can invoke operating system commands, read and write files, and open outbound network connections, so unauthenticated access to it is functionally equivalent to an unauthenticated root shell. An attacker can deploy or modify flows to run arbitrary operating system commands with privileged rights, establish persistence that survives reboot, pivot deeper into the process network, or silently alter the logic the device uses to relay data between production systems. The scope change reflected in the CVSS vector recognizes that compromise of the Node-RED service extends beyond the service itself to the entire host and everything reachable from it. CERT@VDE published the advisory as VDE-2025-045 on July 1, 2025, and NIST has not yet published a CVSS v4.0 score for this CVE.
CVE-2025-41648, with a CVSS v3.1 base score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, is an authentication bypass in the IndustrialPI webstatus web application, classified under CWE-704, Incorrect Type Conversion or Cast. All webstatus versions below 2.4.6 are affected. The underlying defect is a type-handling error in the code path that evaluates login credentials, a class of weakness in which a value supplied by the client is coerced into a type that causes the comparison to succeed regardless of whether the correct credential was provided. The practical result is that an unauthenticated remote attacker reaches the authenticated portion of the web application directly and can then read and change every setting the IndustrialPI exposes, including network parameters, service configuration, and device behavior. Because the webstatus application is the administrative surface of the device, this vulnerability provides both reconnaissance value and a configuration-tampering capability, and it can be chained with the Node-RED exposure to enable services that were previously disabled. CERT@VDE published the advisory as VDE-2025-039 on July 1, 2025, cross-referenced to the Pilz product advisory PPSA-2025-003, and NIST has not yet published a CVSS v4.0 score for this CVE.
Client Impact
For organizations running IndustrialPI 4 hardware in production, the immediate operational exposure is the loss of trust in any process data or control action that passes through the affected devices. An attacker with privileged command execution can alter the flows that translate, buffer, or forward data between field equipment and higher-level systems, meaning historian records, alarm thresholds, and dashboard values may no longer reflect physical reality. Because these devices are commonly used as protocol gateways and edge collectors rather than as primary controllers, their compromise is easy to overlook while it simultaneously provides an attacker with a durable, low-visibility foothold on the operational network. Recovery is complicated by the fact that a compromised Linux-based edge device generally must be reimaged rather than cleaned, which in many plants means unplanned downtime for the cell or line the device serves.
The compliance dimension is equally significant. Both vulnerabilities represent unauthenticated remote access to a device inside the operational environment, which directly implicates access-control and system-integrity requirements under NERC CIP for in-scope electric utility assets, IEC 62443-3-3 system requirements for identification, authentication, and use control, and the NIS2 Directive's risk-management and incident-reporting obligations for operators in the European Union. Organizations subject to these frameworks should expect that an unpatched device carrying a CVSS 10.0 unauthenticated remote code execution flaw will be treated as a material finding in audit or assessment. Where the affected device sits within a defined security zone or electronic security perimeter, the missing authentication on Node-RED may also constitute a documented deviation from the zone's stated conduit and access-control model, requiring formal remediation tracking regardless of whether exploitation is observed.
Mitigations
Organizations operating Pilz IndustrialPI 4 devices should take the following actions to reduce exposure to these vulnerabilities:
- Update the IndustrialPI webstatus package to version 2.4.6 or later on every affected device by running sudo apt update followed by sudo apt upgrade -y, then confirm the installed version with dpkg -l | grep revpi-webstatus before returning the device to service.
- Enable authentication on the Node-RED service on every IndustrialPI 4 running Firmware Bullseye 2024-08 or earlier, following the remediation procedure published by Pilz; note that the Node-RED service must first be activated through the web application before authentication can be applied, and devices where Node-RED is not required should have the service disabled entirely.
- Restrict network access to the IndustrialPI using firewall rules, access control lists, or equivalent segmentation controls so that the webstatus interface and the Node-RED port are reachable only from a defined engineering workstation range, and confirm that neither service is reachable from the enterprise network or the internet.
- Inventory all IndustrialPI and related Raspberry Pi-based industrial computers across the environment, recording firmware image date and webstatus package version, since these devices are frequently deployed by machine builders and integrators without being captured in the asset management system.
- Review historical logs and network flow records for unauthenticated connections to the Node-RED port and for webstatus sessions that were not preceded by a successful authentication event, and treat any configuration change on an affected device that cannot be tied to a documented change request as a potential compromise indicator.
Applying the webstatus update and enabling Node-RED authentication together removes both attack paths; segmentation and monitoring should remain in place afterward to limit exposure from future defects in the same interfaces.
1898 & Co. Response
1898 & Co. works alongside industrial and critical infrastructure operators to identify, prioritize, and remediate vulnerabilities in the embedded devices that sit closest to physical processes. Our security consultants have supported asset owners across power generation, transmission and distribution, water, manufacturing, and oil and gas in building accurate device inventories and applying risk-based remediation sequencing to equipment that cannot simply be patched on an IT schedule.
Our managed threat detection and response service is built specifically for operational technology environments and monitors for the behaviors these vulnerabilities enable, including unauthenticated access to engineering and flow-programming services, unexpected command execution on edge devices, and configuration changes that do not correspond to authorized change activity. Analysts in our Managed Security Operations Center review this telemetry with an understanding of process context, so that anomalous activity on a gateway or edge collector is evaluated against what that device is supposed to do in the plant rather than in isolation.
For organizations seeking to reduce exposure to this class of issue over the longer term, 1898 & Co. performs in-depth OT security assessments, network segmentation reviews, and architecture design work aligned to IEC 62443 and NERC CIP. These engagements are designed to establish enforceable zone and conduit boundaries, remove unnecessary management-interface exposure, and give asset owners a defensible basis for the decisions they make about devices that cannot be taken offline on demand.