CVE-2025-35996: Cross-Site Scripting Attack in KUNBUS PiCtory

Overview

In the ever-evolving landscape of cyber threats, a new vulnerability has been reported in KUNBUS PiCtory version 2.11.1 and earlier. This vulnerability, designated as CVE-2025-35996, is a severe security flaw that could potentially lead to system compromise or data leakage. It affects users of the KUNBUS PiCtory software, a configuration tool widely used in industrial automation. The severity of this vulnerability underscores the importance of constant vigilance and timely patching in the world of cybersecurity.

Vulnerability Summary

CVE ID: CVE-2025-35996
Severity: Critical (CVSS: 9.0)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: System compromise, potential data leakage

Affected Products

Product | Affected Versions

KUNBUS PiCtory | 2.11.1 and earlier

How the Exploit Works

The vulnerability in question arises when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. When this filename is transmitted to the client for displaying a list of configuration files, it is not properly sanitized or escaped. As a result, the attacker can inject HTML script tags in the filename, which can then be executed when the filename is rendered on the client side. This leads to a classic cross-site-scripting attack, potentially compromising the victim’s system or leading to data leakage.

Conceptual Example Code

Below is a conceptual example of how the vulnerability might be exploited. This example assumes that the malicious user is authenticated and has the ability to create files with arbitrary names.

POST /api/files HTTP/1.1
Host: target.example.com
Content-Type: application/json
Authorization: Bearer <auth_token>
{ "filename": "<script>malicious_code_here</script>.cfg" }

In this example, the filename contains a script tag with malicious code. When this filename is retrieved and displayed by the client, the embedded script is executed, leading to a cross-site-scripting attack.

Mitigation

To mitigate this vulnerability, users should apply the vendor patch as soon as it becomes available. In the meantime, they can use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) as temporary mitigation. It’s also recommended to review and sanitize all filenames before rendering them on the client side.