Pilz vulnerabilities
10 vulnerabilities
Known vulnerabilities in Pilz products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 23 products.
Products
23- Pasvisu3 vulnerabilities
- Pmc3 vulnerabilities
- PMI V8Xx2 vulnerabilities
- Pnozmulti Configurator2 vulnerabilities
- Industrialpi 4 With Firmware Bullseye1 vulnerabilities
- Industrialpi 4 With Industrialpi Webstatus1 vulnerabilities
- Pas 40001 vulnerabilities
- Pas40001 vulnerabilities
- Pascal1 vulnerabilities
- Pasconnect1 vulnerabilities
- Pasmotion1 vulnerabilities
- Pilz Pnozmulti Configurator1 vulnerabilities
- Pmi V5071 vulnerabilities
- Pmi V5121 vulnerabilities
- PMI V5Xx (265507 + 265512)1 vulnerabilities
- Pmi V704E1 vulnerabilities
- Pmi V707E1 vulnerabilities
- PMI V7Xx (266704 + 266707)1 vulnerabilities
- Pmi V8071 vulnerabilities
- Pmi V8121 vulnerabilities
- Pmi V8151 vulnerabilities
- PMI V8Xx (266807, 266812, 266815)1 vulnerabilities
- Pnozmulti Configurator LTS1 vulnerabilities
CVE-2018-19009pilzpilz pnozmulti configurator+1
EPSS score0.24%
Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker with access to this sensitive data and physical access to the PMI m107 diag can modify data on the HMI device.CVE-2025-41648pilzindustrialpi 4 with industrialpi webstatusEPSS score0.83%
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.CVE-2025-41656pilzindustrialpi 4 with firmware bullseyeEPSS score12.35%
An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.CVE-2020-12069codesyscodesys v3 containing the cmpusermgr+64EPSS score0.17%
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.CVE-2020-12067pilzpmcEPSS score0.52%
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.CVE-2022-40977pilzpasvisu+10EPSS score0.92%
A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.CVE-2022-40976pilzpas_4000+10EPSS score0.23%
A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.CVE-2019-9011pilzpmcEPSS score0.46%
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.CVE-2023-45796pilzpasvisu+1EPSS score0.63%
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity and/or availability.CVE-2023-45795pilzpasvisu+1EPSS score0.21%
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.