Pilz: Authentication Bypass and Cross-Site-Scripting in PiCtory

An attacker could bypass authentication on the PiCtory configuration interface and execute arbitrary commands on the IndustrialPI, potentially altering automation logic, stopping processes, or gaining control of connected production equipment. Malicious scripts could also be injected to steal credentials or redirect operators to fake login pages.

Manufacturing organizations using Pilz IndustrialPI industrial PCs with PiCtory web-based configuration tools are affected. This includes facility automation managers, plant engineers, and system integrators who rely on PiCtory to configure automation controllers, safety systems, and process logic.

An attacker with network access to the IndustrialPI's web interface (port 80/443) can send a specially crafted request to bypass authentication controls without valid credentials. Once authenticated, the attacker can inject malicious JavaScript into the web application, which executes in the browser of any operator who views the affected page, allowing credential theft or further system compromise.