Description
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pilz | PMI v8xx | 0.0.0 – ≤ 2.0.33992 | — |
| Pilz | PASvisu | 0.0.0 – < 1.14.1 | 1.14.1 |
Advisories 1
- VDE-2023-050 Pilz: Vulnerability in PASvisu and PMI v8xx CERT@VDE · Apr 10, 2025
References
- https://certvde.com/en/advisories/VDE-2023-050/ vendor-advisory