PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-32011 KUNBUS GmbH CVE debrief

CVE-2025-32011 is a critical remote authentication bypass affecting KUNBUS Revolution Pi PiCtory versions 2.5.0 through 2.11.1. The issue is described in the CISA CSAF advisory as a path traversal condition that can let a remote attacker access the application without valid authentication. CISA published the advisory on 2025-05-01 and updated it on 2025-07-10, noting an additional image release in the mitigation guidance.

Vendor
KUNBUS GmbH
Product
Revolution Pi OS Bookworm
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-05-01
Original CVE updated
2025-07-10
Advisory published
2025-05-01
Advisory updated
2025-07-10

Who should care

Industrial control system and OT operators using KUNBUS Revolution Pi PiCtory, especially systems running versions 2.5.0 through 2.11.1. Also relevant for administrators, integrators, and anyone responsible for remote access, authentication controls, or patching of Revolution Pi environments.

Technical summary

The source advisory states that KUNBUS PiCtory versions 2.5.0 through 2.11.1 contain an authentication bypass vulnerability caused by path traversal. Because the vulnerability is network-reachable and requires no privileges or user interaction, its attack surface is broad. The advisory’s remediation is to update PiCtory to version 2.12; it also recommends enabling authentication where applicable and notes that a Cockpit-based update path is preferred.

Defensive priority

Immediate

Recommended defensive actions

  • Update KUNBUS PiCtory to version 2.12 as soon as possible.
  • Use KUNBUS Cockpit to apply the update where that is the preferred management path.
  • If immediate patching is not possible, activate authentication as recommended in the vendor remediation guide.
  • Review exposed management interfaces and restrict access to trusted administrative networks only.
  • Validate whether any Revolution Pi deployments are running affected PiCtory versions 2.5.0 through 2.11.1 and prioritize those systems for remediation.

Evidence notes

The debrief is based on the CISA CSAF advisory ICSA-25-121-01 and the linked CVE record. The advisory metadata names KUNBUS PiCtory versions 2.5.0 through 2.11.1 as affected and identifies update guidance to version 2.12. The advisory revision history shows the initial publication date as 2025-05-01 and Update A on 2025-07-10, which added a new image release to the mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-32011 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-32011

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-32011 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-32011

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-121-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.