Medium Patch available
Pilz IndustrialPI tools have flaws allowing session takeover and file deletion
CERT@VDE advisoriesPilz, IndustrialPI
What happened. Pilz reported two flaws for IndustrialPI. The PiCtory web tool before 2.17.0 has a cross-site request forgery flaw that allows session takeover. RevPiPyLoad before 0.11.1 lets an attacker access or delete files through its XML-RPC interface.
Who is affected. Pilz IndustrialPI users running PiCtory before 2.17.0 or RevPiPyLoad before 0.11.1. The source names no sectors.
What to do. Check whether you run PiCtory before 2.17.0 or RevPiPyLoad before 0.11.1, and update to the fixed versions per Pilz advisory PPSA-2026-005.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
- L1
Why: IndustrialPI is an industrial PC that runs control logic, and its web configuration tool and XML-RPC service are used from engineering hosts, so L1 and L2.
- Are you exposed?
Check each IndustrialPI unit for installed PiCtory and RevPiPyLoad versions, and whether the web and XML-RPC interfaces are reachable from other networks.
- If you cannot fix it yet
- Block access to the PiCtory web interface and the XML-RPC interface except from known engineering hosts.
- Avoid browsing other websites in a session logged in to PiCtory.
- Watch for
- XML-RPC requests to RevPiPyLoad from unknown hosts, especially file read or delete calls.
- Unexpected changes to PiCtory configuration following a user's visit to an outside web page.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.