Vulnerability · Published Jul 1, 2025 · Assigned by CERTVDE
CVE-2025-41648Pilz: Authentication Bypass in IndustrialPI Webstatus
Critical 9.8
In plain English
A critical-severity security flaw in IndustrialPI 4 with IndustrialPI webstatus from Pilz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 42.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Pilz | IndustrialPI 4 with IndustrialPI webstatus | 0 – before 2.4.6 |
Weakness: CWE-704 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H