Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2025-41656

Pilz: Missing Authentication in Node-RED integration

Description

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Pilz IndustrialPI 4 with Firmware Bullseye

Default version status: unaffected

  • 0 to ≤ 2024-08affected

References