CVE-2025-32011
Published: 01 May 2025
Summary
CVE-2025-32011 is a critical-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 47.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
KUNBUS PiCtory versions 2.5.0 through 2.11.1 contain an authentication bypass vulnerability stemming from a path traversal flaw, tracked as CVE-2025-32011 and assigned CWE-305. The issue permits remote, unauthenticated access to the affected industrial configuration software and carries a CVSS 4.0 score of 9.3 reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.
A remote attacker can exploit the flaw without credentials or user interaction to bypass authentication controls and obtain unauthorized access to the PiCtory instance, potentially allowing full compromise of the system and connected industrial components.
CISA has published ICSA-25-121-01 addressing the vulnerability, while updated packages are referenced at the Revolution Pi repository; operators should apply available updates or follow the advisory guidance for mitigation. The associated EPSS score rose materially from a low baseline to a peak of 0.0239 on 2026-02-25 before receding, indicating post-disclosure exploitation interest that warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13269
Vulnerability details
KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.