Pilz: Multiple Vulnerabilities affecting the PIT User Authentication Service

An attacker on the network could crash or degrade the PIT User Authentication Service, preventing access control functions and potentially disrupting authorized user authentication to safety or operating mode systems. The service is integral to PITmode access permissions, so unavailability could affect operation of protected systems.

This affects users of Pilz PIT (Product Information Terminal) systems, particularly those using PITmode for access control and operating mode selection in manufacturing or safety-critical applications. The PIT User Authentication Service is the authentication backend for PITreader devices, so any facility relying on PITmode access permissions should assess exposure.

An attacker with network access to the PIT User Authentication Service could send crafted requests that trigger denial-of-service conditions or resource exhaustion in the third-party components embedded in the service. No authentication is required to initiate the attack.