Kunbus vulnerabilities
We track 7 vulnerabilities in Kunbus products across 6 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on August 14, 2026.
Latest Kunbus vulnerabilities
- 7.3 High severity
piControl: Concurrent Execution using Shared Resource with Improper Synchronization
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-image management functionality of KUNBUS piControl in version 2.6.2 that allow
- 7.3 High severity
piControl: Out-of-bounds Write
Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-contro
- 9.8 Critical severity
Revolution Pi webstatus: Incorrect Type Conversion or Cast
An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
- 9.0 Critical severity
Revolution Pi PiCtory: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due t
- 9.8 Critical severity
Revolution Pi PiCtory: Authentication Bypass by Primary Weakness
KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.
- 10.0 Critical severity
Revolution Pi OS Bookworm: Authentication Bypass by Primary Weakness
KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the
- 8.3 High severity
Revolution Pi: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ parameter