What’s Vulnerable › Vulnerabilities

CVE-2022-40977: PILZ: PASvisu and PMI affected by ZipSlip

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-24 · updated 2026-06-17
• Weakness: CWE-22

Description

A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

Affected products

• Pilz PASvisu: before 1.12.0 — fixed in 1.12.0
• PILZ Pmi V507 Firmware: through 1.3.58
• PILZ Pmi V512 Firmware: through 1.3.58
• PILZ Pmi V704E Firmware: before 2.2.0 — fixed in 2.2.0
• PILZ Pmi V707E Firmware: before 2.2.0 — fixed in 2.2.0
• PILZ Pmi V807 Firmware: before 1.6.102 — fixed in 1.6.102
• PILZ Pmi V812 Firmware: before 1.6.102 — fixed in 1.6.102
• PILZ Pmi V815 Firmware: before 1.6.102 — fixed in 1.6.102

How to fix

Upgrade to a fixed version: Pilz PASvisu 1.12.0; PILZ Pmi V704E Firmware 2.2.0; PILZ Pmi V707E Firmware 2.2.0; PILZ Pmi V807 Firmware 1.6.102; PILZ Pmi V812 Firmware 1.6.102; PILZ Pmi V815 Firmware 1.6.102. Check the vendor advisory for mitigations.

References

• https://cert.vde.com/en/advisories/VDE-2022-033/
• https://cert.vde.com/en/advisories/VDE-2022-033/

Get alerted when CVE-2022-40977 or the next vulnerability affects your stack