OTPulse

Pilz: Multiple Vulnerabilities affecting industrial PC IndustrialPI

Act NowCVSS 8.8PPSA-2026-003Aug 4, 2026
PilzManufacturing
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

The Linux kernel (linux-image-revpi-v8) used in Pilz IndustrialPI 4 devices contains multiple privilege escalation vulnerabilities (CWE-669, CWE-123, CWE-787). Versions 6.6.0-revpi8-rpi-v8 through 6.12.90-revpi0-rpi-v8 are affected. Successful exploitation grants an attacker with local user access full root-level control of the device, enabling arbitrary command execution and process manipulation.

What this means
What could happen
An attacker with local access to an IndustrialPI device could gain full control of it, allowing them to modify process setpoints, stop production, or inject malicious commands into safety-critical automation logic.
Who's at risk
Manufacturing facilities using Pilz IndustrialPI 4 for production control, process automation, and safety logic execution should prioritize this update. Any site relying on this device for PLC-like automation functions is at risk.
How it could be exploited
An attacker with a local user account on the IndustrialPI exploits kernel vulnerabilities (CWE-669, CWE-123, CWE-787) to escalate privileges and gain root-level control. From there, they can modify any process or safety function running on the device.
Prerequisites
  • Local user account on the IndustrialPI device
  • IndustrialPI 4 running kernel versions 6.6.0-revpi8-rpi-v8 through 6.12.90-revpi0-rpi-v8
actively exploited (KEV)high EPSS score (94.5%)affects safety systemslow complexitylocal code execution to full device control
Exploitability
Actively exploited — confirmed by CISA KEV
Metasploit module available — weaponized exploitView module ↗
Public Proof-of-Concept (PoC) on GitHub (10 repositories)
Affected products (1)
ProductAffected VersionsFix Status
IndustrialPI 4≥ 6.6.0-revpi8-rpi-v8, < 6.12.91-revpi0-rpi-v8Fix available
Remediation & Mitigation
0/2
Do now
0/2
HOTFIXUpdate kernel package linux-image-revpi-v8 to version 6.12.91-revpi0-rpi-v8 or later
HOTFIXUpdate IndustrialPI firmware to version 17.06.2026 or later
View full CERT@VDE advisory
API: /api/v1/advisories/e634f5f6-fccc-4f7d-b33c-170c3c318eb7

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Pilz: Multiple Vulnerabilities affecting industrial PC IndustrialPI | CVSS 8.8 - OTPulse