PPSA-2026-004

Vulnerability from csaf_pilzgmbhcokg - Published: 2026-10-20 11:00 - Updated: 2026-10-20 11:00
Summary
Pilz: Vulnerabilities in 'piControl' kernel module for Industrial PC IndustrialPI
Severity
High
Notes
Summary: The 'piControl' kernel module used in the IndustrialPI, prior to version 2.8.0-1, contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can lead to kernel memory corruption and denial of service.
Impact: Authenticated users with the ability to execute their own code on the device can exploit these vulnerabilities for a kernel memory corruption and denial of service.
General Recommendations: Ensure that only trusted code is executed on the device.
Remediation: Update package 'picontrol' to version 2.8.0-1 or higher.
CVE-2026-13196

Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the process-image buffer and corrupt adjacent kernel memory, resulting in kernel memory corruption and denial of service, by supplying crafted device configuration data and crafted input through the piControl character device.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Vendor Fix Update package 'picontrol' to version 2.8.0-1 or higher.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31008 —
Unresolved product id: CSAFPID-31009 —
Unresolved product id: CSAFPID-31010 —
Unresolved product id: CSAFPID-31011 —
Unresolved product id: CSAFPID-32000 —
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31004 —
Unresolved product id: CSAFPID-31005 —
Unresolved product id: CSAFPID-31006 —
Unresolved product id: CSAFPID-31007 —
CVE-2026-13197

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.

7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vendor Fix Update package 'picontrol' to version 2.8.0-1 or higher.
Affected products
Fixed 8 products, the same list as for CVE-2026-13196
Known affected 4 products, the same list as for CVE-2026-13196
CVE-2026-13198

Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests from multiple threads through the piControl character device.

6.5 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vendor Fix Update package 'picontrol' to version 2.8.0-1 or higher.
Affected products
Product Identifier Version Remediation
Unresolved product id: CSAFPID-32000 —
Unresolved product id: CSAFPID-32001 —
Unresolved product id: CSAFPID-32002 —
Unresolved product id: CSAFPID-32003 —
Product Identifier Version Remediation
Unresolved product id: CSAFPID-31012 —
Unresolved product id: CSAFPID-31013 —
Unresolved product id: CSAFPID-31014 —
Unresolved product id: CSAFPID-31015 —
References
Acknowledgments
CERT@VDE certvde.com
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "High"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The \u0027piControl\u0027 kernel module used in the IndustrialPI, prior to version 2.8.0-1, contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can lead to kernel memory corruption and denial of service. ",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Authenticated users with the ability to execute their own code on the device can exploit these vulnerabilities for a kernel memory corruption and denial of service. ",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Ensure that only trusted code is executed on the device.",
        "title": "General Recommendations"
      },
      {
        "category": "description",
        "text": "Update package \u0027picontrol\u0027 to version 2.8.0-1 or higher.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@pilz.com",
      "name": "Pilz GmbH \u0026 Co. KG",
      "namespace": "https://www.pilz.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "For further security-related issues in Pilz products please contact the Pilz Product Security Incident Response Team (PSIRT)",
        "url": "https://www.pilz.com/security"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Pilz GmbH \u0026 Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/pilz/"
      },
      {
        "category": "self",
        "summary": "PPSA-2026-004: Pilz: Vulnerabilities in \u0027piControl\u0027 kernel module for Industrial PC IndustrialPI - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-100/"
      },
      {
        "category": "self",
        "summary": "PPSA-2026-004: Pilz: Vulnerabilities in \u0027piControl\u0027 kernel module for Industrial PC IndustrialPI - CSAF",
        "url": "https://pilz.csaf-tp.certvde.com/.well-known/csaf/white/2026/ppsa-2026-004.json"
      }
    ],
    "title": "Pilz: Vulnerabilities in \u0027piControl\u0027 kernel module for Industrial PC IndustrialPI",
    "tracking": {
      "aliases": [
        "VDE-2026-100",
        "PPSA-2026-004"
      ],
      "current_release_date": "2026-10-20T11:00:00.000Z",
      "generator": {
        "date": "2026-10-15T11:59:20.790Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.14"
        }
      },
      "id": "PPSA-2026-004",
      "initial_release_date": "2026-10-20T11:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-20T11:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial Version"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IndustrialPI 4",
                "product": {
                  "name": "IndustrialPI 4",
                  "product_id": "CSAFPID-11000",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:pilz:industrialpi_4:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "A1000002",
                      "A1000003"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "vers:generic/10.06.2025",
                    "product": {
                      "name": "IndustrialPI OS 10.06.2025",
                      "product_id": "CSAFPID-21000",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "vers:generic/23.06.2025",
                    "product": {
                      "name": "IndustrialPI OS 23.06.2025",
                      "product_id": "CSAFPID-21001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "vers:generic/25.12.2025",
                    "product": {
                      "name": "IndustrialPI OS 25.12.2025",
                      "product_id": "CSAFPID-21002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "vers:generic/15.06.2026",
                    "product": {
                      "name": "IndustrialPI OS 15.06.2026",
                      "product_id": "CSAFPID-21003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "IndustrialPI OS"
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Pilz"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:deb/\u003e=2.3.6-1|\u003c2.7.0-1",
                    "product": {
                      "name": "picontrol \u003c2.7.0-1",
                      "product_id": "CSAFPID-90000",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version_range",
                    "name": "vers:deb/\u003e=2.3.6-1|\u003c2.8.0-1",
                    "product": {
                      "name": "picontrol \u003c2.8.0-1",
                      "product_id": "CSAFPID-90001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "vers:deb/2.7.0-1",
                    "product": {
                      "name": "picontrol 2.7.0-1",
                      "product_id": "CSAFPID-90002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "vers:deb/2.8.0-1",
                    "product": {
                      "name": "picontrol 2.8.0-1",
                      "product_id": "CSAFPID-90003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:o:kunbus:picontrol:*:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "picontrol"
              }
            ],
            "category": "product_family",
            "name": "OS"
          }
        ],
        "category": "vendor",
        "name": "KUNBUS"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007"
        ],
        "summary": "Affected products (CVE-2026-13196 \u0026 CVE-2026-13197)."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015"
        ],
        "summary": "Affected products (CVE-2026-13198)."
      },
      {
        "group_id": "CSAFGID-0003",
        "product_ids": [
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-32000",
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003"
        ],
        "summary": "Fixed products (CVE-2026-13196 \u0026 CVE-2026-13197)."
      },
      {
        "group_id": "CSAFGID-0004",
        "product_ids": [
          "CSAFPID-32000",
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003"
        ],
        "summary": "Fixed products (CVE-2026-13198)."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IndustrialPI OS 10.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31000",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21000",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IndustrialPI OS 23.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IndustrialPI OS 25.12.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IndustrialPI OS 15.06.2026 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11000"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "picontrol \u003c2.7.0-1 default component of IndustrialPI OS 10.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90000",
        "relates_to_product_reference": "CSAFPID-31000"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "picontrol \u003c2.7.0-1 default component of IndustrialPI OS 23.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31005",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90000",
        "relates_to_product_reference": "CSAFPID-31001"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "picontrol \u003c2.7.0-1 default component of IndustrialPI OS 25.12.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31006",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90000",
        "relates_to_product_reference": "CSAFPID-31002"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "picontrol \u003c2.7.0-1 default component of IndustrialPI OS 15.06.2026 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31007",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90000",
        "relates_to_product_reference": "CSAFPID-31003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.7.0-1 installed on IndustrialPI OS 10.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31008",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90002",
        "relates_to_product_reference": "CSAFPID-31000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.7.0-1 installed on IndustrialPI OS 23.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31009",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90002",
        "relates_to_product_reference": "CSAFPID-31001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.7.0-1 installed on IndustrialPI OS 25.12.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31010",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90002",
        "relates_to_product_reference": "CSAFPID-31002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.7.0-1 installed on IndustrialPI OS 15.06.2026 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31011",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90002",
        "relates_to_product_reference": "CSAFPID-31003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol \u003c2.8.0-1 installed on IndustrialPI OS 10.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31012",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90001",
        "relates_to_product_reference": "CSAFPID-31000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol \u003c2.8.0-1 installed on IndustrialPI OS 23.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31013",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90001",
        "relates_to_product_reference": "CSAFPID-31001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol \u003c2.8.0-1 installed on IndustrialPI OS 25.12.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31014",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90001",
        "relates_to_product_reference": "CSAFPID-31002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol \u003c2.8.0-1 installed on IndustrialPI OS 15.06.2026 installed on IndustrialPI 4",
          "product_id": "CSAFPID-31015",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90001",
        "relates_to_product_reference": "CSAFPID-31003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.8.0-1 installed on IndustrialPI OS 10.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-32000",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:10.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90003",
        "relates_to_product_reference": "CSAFPID-31000"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.8.0-1 installed on IndustrialPI OS 23.06.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-32001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:23.06.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90003",
        "relates_to_product_reference": "CSAFPID-31001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.8.0-1 installed on IndustrialPI OS 25.12.2025 installed on IndustrialPI 4",
          "product_id": "CSAFPID-32002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:25.12.2025:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90003",
        "relates_to_product_reference": "CSAFPID-31002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "picontrol 2.8.0-1 installed on IndustrialPI OS 15.06.2026 installed on IndustrialPI 4",
          "product_id": "CSAFPID-32003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:pilz:industrialpi_firmware:15.06.2026:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-90003",
        "relates_to_product_reference": "CSAFPID-31003"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13196",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the process-image buffer and corrupt adjacent kernel memory, resulting in kernel memory corruption and denial of service, by supplying crafted device configuration data and crafted input through the piControl character device.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-32000",
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003"
        ],
        "known_affected": [
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update package \u0027picontrol\u0027 to version 2.8.0-1 or higher.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "modifiedAttackComplexity": "LOW",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "LOW",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007"
          ]
        }
      ],
      "title": "Out-of-bounds Write in KUNBUS piControl"
    },
    {
      "cve": "CVE-2026-13197",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests through the piControl character device.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-32000",
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003"
        ],
        "known_affected": [
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update package \u0027picontrol\u0027 to version 2.8.0-1 or higher.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "modifiedAttackComplexity": "HIGH",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "LOW",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007"
          ]
        }
      ],
      "title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) in KUNBUS piControl"
    },
    {
      "cve": "CVE-2026-13198",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "notes": [
        {
          "category": "description",
          "text": "Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in the event notification functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker to corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory, resulting in kernel memory corruption and denial of service, by issuing concurrent crafted requests from multiple threads through the piControl character device.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32000",
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003"
        ],
        "known_affected": [
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update package \u0027picontrol\u0027 to version 2.8.0-1 or higher.",
          "group_ids": [
            "CSAFGID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 6.5,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "HIGH",
            "modifiedAttackComplexity": "HIGH",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "LOW",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "LOW",
            "modifiedScope": "UNCHANGED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015"
          ]
        }
      ],
      "title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) in KUNBUS piControl"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.