Pilz: Vulnerabilities in 'piControl' kernel module for Industrial PC IndustrialPI
Plan PatchCVSS 7.8PPSA-2026-004Oct 20, 2026
PilzManufacturing
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
The 'piControl' kernel module in IndustrialPI contains multiple vulnerabilities (CWE-787 out-of-bounds write, CWE-362 race condition) that can lead to kernel memory corruption and denial of service. Versions 2.3.6-1 through 2.7.x are affected.
What this means
What could happen
An attacker with local access could cause kernel memory corruption or crash the IndustrialPI system, disrupting industrial PC-based control functions and potentially causing loss of process monitoring or control capability.
Who's at risk
Manufacturing facilities and industrial automation environments that rely on Pilz IndustrialPI as a control or monitoring platform. This includes facilities using the IndustrialPI for programmable logic control, sensor data processing, or communication gateway functions in production lines, assembly systems, or process control applications.
How it could be exploited
An attacker with a user account on the IndustrialPI system interacts with the 'piControl' kernel module through a user-space interface. By exploiting an out-of-bounds write or race condition in the module, the attacker can corrupt kernel memory or trigger a denial of service condition, causing system instability or crash.
Prerequisites
- Local user account on the IndustrialPI system
- Ability to interact with piControl kernel module user-space interface
low complexityhigh CVSS score (7.8)affects industrial PC control functionskernel-level impact
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
IndustrialPI 4≥ 2.3.6-1, < 2.7.0-12.8.0-1
IndustrialPI 4≥ 2.3.6-1, < 2.8.0-12.8.0-1
Remediation & Mitigation
0/3
Do now
0/2HARDENINGRestrict local user access to IndustrialPI systems to authorized personnel only through access control lists and user account management
WORKAROUNDDisable or isolate piControl kernel module functionality that is not required for operations
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate 'picontrol' package to version 2.8.0-1 or higher on all IndustrialPI systems
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0997be27-a167-45e2-bbbf-cc570b209134Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.