{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]}],"aggregate_severity":{"namespace":"https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale","text":"High"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"The 'piControl' kernel module used in the IndustrialPI, prior to version 2.8.0-1, contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can lead to kernel memory corruption and denial of service. ","title":"Summary"},{"category":"description","text":"Authenticated users with the ability to execute their own code on the device can exploit these vulnerabilities for a kernel memory corruption and denial of service. ","title":"Impact"},{"category":"description","text":"Ensure that only trusted code is executed on the device.","title":"General Recommendations"},{"category":"description","text":"Update package 'picontrol' to version 2.8.0-1 or higher.","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"security@pilz.com","name":"Pilz GmbH & Co. KG","namespace":"https://www.pilz.com"},"references":[{"category":"external","summary":"For further security-related issues in Pilz products please contact the Pilz Product Security Incident Response Team (PSIRT)","url":"https://www.pilz.com/security"},{"category":"external","summary":"CERT@VDE Security Advisories for Pilz GmbH & Co. KG","url":"https://certvde.com/en/advisories/vendor/pilz/"},{"category":"self","summary":"PPSA-2026-004: Pilz: Vulnerabilities in 'piControl' kernel module for Industrial PC IndustrialPI - HTML","url":"https://certvde.com/en/advisories/VDE-2026-100/"},{"category":"self","summary":"PPSA-2026-004: Pilz: Vulnerabilities in 'piControl' kernel module for Industrial PC IndustrialPI - CSAF","url":"https://pilz.csaf-tp.certvde.com/.well-known/csaf/white/2026/ppsa-2026-004.json"}],"title":"Pilz: Vulnerabilities in 'piControl' kernel module for Industrial PC IndustrialPI","tracking":{"aliases":["VDE-2026-100","PPSA-2026-004"],"current_release_date":"2026-10-20T11:00:00.000Z","generator":{"date":"2026-10-15T11:59:20.790Z","engine":{"name":"Secvisogram","version":"2.6.14"}},"id":"PPSA-2026-004","initial_release_date":"2026-10-20T11:00:00.000Z","revision_history":[{"date":"2026-10-20T11:00:00.000Z","number":"1.0.0","summary":"Initial Version"}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"IndustrialPI 4","product":{"name":"IndustrialPI 4","product_id":"CSAFPID-11000","product_identification_helper":{"cpe":"cpe:2.3:h:pilz:industrialpi_4:*:*:*:*:*:*:*:*","model_numbers":["A1000002","A1000003"]}}}],"category":"product_family","name":"Hardware"},{"branches":[{"branches":[{"category":"product_version","name":"vers:generic/10.06.2025","product":{"name":"IndustrialPI OS 10.06.2025","product_id":"CSAFPID-21000","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"vers:generic/23.06.2025","product":{"name":"IndustrialPI OS 23.06.2025","product_id":"CSAFPID-21001","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"vers:generic/25.12.2025","product":{"name":"IndustrialPI OS 25.12.2025","product_id":"CSAFPID-21002","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"vers:generic/15.06.2026","product":{"name":"IndustrialPI OS 15.06.2026","product_id":"CSAFPID-21003","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"IndustrialPI OS"}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"Pilz"},{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"vers:deb/>=2.3.6-1|<2.7.0-1","product":{"name":"picontrol <2.7.0-1","product_id":"CSAFPID-90000","product_identification_helper":{"cpe":"cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":"vers:deb/>=2.3.6-1|<2.8.0-1","product":{"name":"picontrol <2.8.0-1","product_id":"CSAFPID-90001","product_identification_helper":{"cpe":"cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"vers:deb/2.7.0-1","product":{"name":"picontrol 2.7.0-1","product_id":"CSAFPID-90002","product_identification_helper":{"cpe":"cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"vers:deb/2.8.0-1","product":{"name":"picontrol 2.8.0-1","product_id":"CSAFPID-90003","product_identification_helper":{"cpe":"cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"picontrol"}],"category":"product_family","name":"OS"}],"category":"vendor","name":"KUNBUS"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"],"summary":"Affected products (CVE-2026-13196 & CVE-2026-13197)."},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-31012","CSAFPID-31013","CSAFPID-31014","CSAFPID-31015"],"summary":"Affected products (CVE-2026-13198)."},{"group_id":"CSAFGID-0003","product_ids":["CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-32000","CSAFPID-32001","CSAFPID-32002","CSAFPID-32003"],"summary":"Fixed products (CVE-2026-13196 & CVE-2026-13197)."},{"group_id":"CSAFGID-0004","product_ids":["CSAFPID-32000","CSAFPID-32001","CSAFPID-32002","CSAFPID-32003"],"summary":"Fixed products (CVE-2026-13198)."}],"relationships":[{"category":"installed_on","full_product_name":{"name":"IndustrialPI OS 10.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31000","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-21000","relates_to_product_reference":"CSAFPID-11000"},{"category":"installed_on","full_product_name":{"name":"IndustrialPI OS 23.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31001","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11000"},{"category":"installed_on","full_product_name":{"name":"IndustrialPI OS 25.12.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31002","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-21002","relates_to_product_reference":"CSAFPID-11000"},{"category":"installed_on","full_product_name":{"name":"IndustrialPI OS 15.06.2026 installed on IndustrialPI 4","product_id":"CSAFPID-31003","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-21003","relates_to_product_reference":"CSAFPID-11000"},{"category":"default_component_of","full_product_name":{"name":"picontrol <2.7.0-1 default component of IndustrialPI OS 10.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31004","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90000","relates_to_product_reference":"CSAFPID-31000"},{"category":"default_component_of","full_product_name":{"name":"picontrol <2.7.0-1 default component of IndustrialPI OS 23.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31005","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90000","relates_to_product_reference":"CSAFPID-31001"},{"category":"default_component_of","full_product_name":{"name":"picontrol <2.7.0-1 default component of IndustrialPI OS 25.12.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31006","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90000","relates_to_product_reference":"CSAFPID-31002"},{"category":"default_component_of","full_product_name":{"name":"picontrol <2.7.0-1 default component of IndustrialPI OS 15.06.2026 installed on IndustrialPI 4","product_id":"CSAFPID-31007","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90000","relates_to_product_reference":"CSAFPID-31003"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.7.0-1 installed on IndustrialPI OS 10.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31008","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90002","relates_to_product_reference":"CSAFPID-31000"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.7.0-1 installed on IndustrialPI OS 23.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31009","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90002","relates_to_product_reference":"CSAFPID-31001"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.7.0-1 installed on IndustrialPI OS 25.12.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31010","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90002","relates_to_product_reference":"CSAFPID-31002"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.7.0-1 installed on IndustrialPI OS 15.06.2026 installed on IndustrialPI 4","product_id":"CSAFPID-31011","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90002","relates_to_product_reference":"CSAFPID-31003"},{"category":"installed_on","full_product_name":{"name":"picontrol <2.8.0-1 installed on IndustrialPI OS 10.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31012","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90001","relates_to_product_reference":"CSAFPID-31000"},{"category":"installed_on","full_product_name":{"name":"picontrol <2.8.0-1 installed on IndustrialPI OS 23.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31013","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90001","relates_to_product_reference":"CSAFPID-31001"},{"category":"installed_on","full_product_name":{"name":"picontrol <2.8.0-1 installed on IndustrialPI OS 25.12.2025 installed on IndustrialPI 4","product_id":"CSAFPID-31014","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90001","relates_to_product_reference":"CSAFPID-31002"},{"category":"installed_on","full_product_name":{"name":"picontrol <2.8.0-1 installed on IndustrialPI OS 15.06.2026 installed on IndustrialPI 4","product_id":"CSAFPID-31015","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90001","relates_to_product_reference":"CSAFPID-31003"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.8.0-1 installed on IndustrialPI OS 10.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-32000","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90003","relates_to_product_reference":"CSAFPID-31000"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.8.0-1 installed on IndustrialPI OS 23.06.2025 installed on IndustrialPI 4","product_id":"CSAFPID-32001","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90003","relates_to_product_reference":"CSAFPID-31001"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.8.0-1 installed on IndustrialPI OS 25.12.2025 installed on IndustrialPI 4","product_id":"CSAFPID-32002","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90003","relates_to_product_reference":"CSAFPID-31002"},{"category":"installed_on","full_product_name":{"name":"picontrol 2.8.0-1 installed on IndustrialPI OS 15.06.2026 installed on IndustrialPI 4","product_id":"CSAFPID-32003","product_identification_helper":{"cpe":"cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"}},"product_reference":"CSAFPID-90003","relates_to_product_reference":"CSAFPID-31003"}]},"vulnerabilities":[{"cve":"CVE-2026-13196","cwe":{"id":"CWE-787","name":"Out-of-bounds Write"},"notes":[{"category":"description","text":"Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the process-image buffer and corrupt adjacent kernel memory, resulting in kernel memory corruption and denial of service, by supplying crafted device configuration data and crafted input through the piControl character device.","title":"CVE description"}],"product_status":{"fixed":["CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-32000","CSAFPID-32001","CSAFPID-32002","CSAFPID-32003"],"known_affected":["CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"]},"remediations":[{"category":"vendor_fix","details":"Update package 'picontrol' to version 2.8.0-1 or higher.","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":7.8,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","modifiedAttackComplexity":"LOW","modifiedAttackVector":"LOCAL","modifiedAvailabilityImpact":"HIGH","modifiedConfidentialityImpact":"HIGH","modifiedIntegrityImpact":"HIGH","modifiedPrivilegesRequired":"LOW","modifiedScope":"UNCHANGED","modifiedUserInteraction":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":7.8,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"]}],"title":"Out-of-bounds Write in KUNBUS piControl"},{"cve":"CVE-2026-13197","cwe":{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},"notes":[{"category":"description","text":"Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.","title":"CVE description"}],"product_status":{"fixed":["CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-32000","CSAFPID-32001","CSAFPID-32002","CSAFPID-32003"],"known_affected":["CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"]},"remediations":[{"category":"vendor_fix","details":"Update package 'picontrol' to version 2.8.0-1 or higher.","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":7,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","modifiedAttackComplexity":"HIGH","modifiedAttackVector":"LOCAL","modifiedAvailabilityImpact":"HIGH","modifiedConfidentialityImpact":"HIGH","modifiedIntegrityImpact":"HIGH","modifiedPrivilegesRequired":"LOW","modifiedScope":"UNCHANGED","modifiedUserInteraction":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":7,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"]}],"title":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl"},{"cve":"CVE-2026-13198","cwe":{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},"notes":[{"category":"description","text":"Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests from multiple threads through the piControl character device.","title":"CVE description"}],"product_status":{"fixed":["CSAFPID-32000","CSAFPID-32001","CSAFPID-32002","CSAFPID-32003"],"known_affected":["CSAFPID-31012","CSAFPID-31013","CSAFPID-31014","CSAFPID-31015"]},"remediations":[{"category":"vendor_fix","details":"Update package 'picontrol' to version 2.8.0-1 or higher.","group_ids":["CSAFGID-0002"]}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":6.5,"environmentalSeverity":"MEDIUM","integrityImpact":"HIGH","modifiedAttackComplexity":"HIGH","modifiedAttackVector":"LOCAL","modifiedAvailabilityImpact":"HIGH","modifiedConfidentialityImpact":"LOW","modifiedIntegrityImpact":"HIGH","modifiedPrivilegesRequired":"LOW","modifiedScope":"UNCHANGED","modifiedUserInteraction":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":6.5,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"products":["CSAFPID-31012","CSAFPID-31013","CSAFPID-31014","CSAFPID-31015"]}],"title":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControl"}]}