Vulnerability · Published May 1, 2025 · Assigned by icscert
CVE-2025-24522KUNBUS Revolution Pi Authentication Bypass by Primary Weakness
Critical 10.0
In plain English
A critical-severity security flaw in Revolution Pi OS Bookworm from KUNBUS GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.8%top 43.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| KUNBUS GmbH | Revolution Pi OS Bookworm | 0 – through 01/2025 |
Weakness: CWE-305 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H