OTPulse

Pilz: Vulnerabilities in 'PiCtory' and 'RevPiPyLoad' for Industrial PC IndustrialPI

MonitorCVSS 7.1PPSA-2026-005Oct 20, 2026
PilzManufacturing
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

PiCtory, the web-based configuration tool for IndustrialPI 4, contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker with local access to hijack an operator's session and modify process configurations. RevPiPyLoad, the runtime package for industrial process execution, has a file handling vulnerability in its XML-RPC interface that permits arbitrary file read and delete operations on files accessible to the revpipyload process, including critical automation scripts and configurations. Both vulnerabilities require local system access or access to the local network but pose significant risk to process integrity and availability.

What this means
What could happen
An attacker with local access could hijack an operator's configuration session or delete critical system files on your IndustrialPI, potentially disrupting process automation or causing data loss. Remote exploitation is not possible but local compromise poses significant operational risk.
Who's at risk
Manufacturing facilities using Pilz IndustrialPI 4 industrial PCs for process automation and control should be concerned. Specifically, operations relying on PiCtory for configuration management or RevPiPyLoad for runtime process control are at risk. Water treatment, food processing, and discrete manufacturing environments with these systems are affected.
How it could be exploited
An attacker with local account access on the IndustrialPI exploits a CSRF flaw in the PiCtory web configuration tool to forge requests in a logged-in operator's session, or exploits file handling in RevPiPyLoad's XML-RPC interface to read/delete files that the process owns, including configuration or system files critical to automation logic.
Prerequisites
  • Local user account on the IndustrialPI system
  • For CSRF: web browser access to PiCtory management interface while an operator is logged in
  • For RevPiPyLoad: network access to the XML-RPC interface (typically localhost or local network)
Low complexity local exploitationNo authentication required for RevPiPyLoad file accessAffects automation configuration and process control systemsNo patch available for current affected versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (3)
3 pending
ProductAffected VersionsFix Status
IndustrialPI 4≥ 2.13.0-1+deb12+1, < 2.17.0No fix yet
IndustrialPI 4≥ 0.11.0-1+revpi12+1, < 0.11.1No fix yet
IndustrialPI 40.11.1No fix yet
Remediation & Mitigation
0/5
Do now
0/3
HARDENINGRestrict local user account creation and SSH access to IndustrialPI to only authorized engineering staff
HARDENINGRestrict network access to the RevPiPyLoad XML-RPC interface (default port 502 or configured port) to only trusted engineering workstations and automation systems
HARDENINGImplement access controls to the PiCtory web interface to limit who can modify process configuration (use firewall or web server authentication)
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate 'pictory' package to version 2.17.0 or higher
HOTFIXUpdate 'revpipyload' package to version 0.11.1 or higher
View full CERT@VDE advisory
API: /api/v1/advisories/f5f8bf54-0286-4aca-8904-cc18278d56d5

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Pilz: Vulnerabilities in 'PiCtory' and 'RevPiPyLoad' for Industrial PC IndustrialPI | CVSS 7.1 - OTPulse