Summary
**PIT User Authentication Service is part of the operating mode selection and access permission system PITmode.** The PIT User Authentication Service is affected by multiple vulnerabilities in included third-party components.
Details
Impact
The attacker can intercept the communication between the PITreader and the PIT User Authentication Service which can lead to disclosure of the PITreader API token. Furthermore the PIT User Authentication Service is vulnerable to a Denial of Service attack.
Remediation
Please visit the Pilz website (https://www.pilz.com/en-INT/search) and install the new version "Software PIT User Auth. Service 1.4.1" on to your device.
Mitigation
Limit network access to the PITreader and PIT User Authentication Service by using a firewall, a host-based firewall or similar measures.
Vulnerabilities 4
-
Critical 9.4
Race Condition allows Bypass of Trust Restrictions
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under norma…
-
High 7.5
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOf…
-
High 7.5
Apache Tomcat: FileUpload large number of parts with headers DoS
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time th…
-
Medium 5.3
Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS
Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but lef…
Revision history
-
#1.0.1
Summary has been updated.
-
#1.0.0
Initial Version
References
-
For further security-related issues in Pilz products please contact the Pilz Product Security Incident Response Team (PSIRT)
https://www.pilz.com/security
-
CERT@VDE Security Advisories for Pilz GmbH & Co. KG
https://certvde.com/en/advisories/vendor/pilz/
-
PPSA-2026-001: Pilz: Multiple Vulnerabilities affecting the PIT User Authentication Service - HTML
https://certvde.com/en/advisories/VDE-2026-006/