Description
A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.
References (1)
Core 1
Core References
Mitigation, Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2022-033/
Scores
CVSS v3
7.5
EPSS
0.0086
EPSS Percentile
53.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (8)
pilz/pasvisu
< 1.12.0
pilz/pmi_v507_firmware
< 1.3.58
pilz/pmi_v512_firmware
< 1.3.58
pilz/pmi_v704e_firmware
< 2.2.0
pilz/pmi_v707e_firmware
< 2.2.0
pilz/pmi_v807_firmware
< 1.6.102
pilz/pmi_v812_firmware
< 1.6.102
pilz/pmi_v815_firmware
< 1.6.102
Published
Nov 24, 2022
Tracked Since
Feb 18, 2026