CVE-2026-57472
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A CWE-22 Path Traversal vulnerability was identified in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad version 0.11.0. A local unauthenticated attacker can delete arbitrary files with the privileges of the RevPiPyLoad daemon, leading to loss of configuration integrity and denial of service.
Risk Assessment
The risk includes the possibility of local deletion of critical configuration files, potentially leading to system disruption and loss of configuration integrity.
Recommendation
It is recommended to update RevPiPyLoad to the latest version and restrict access to the local management interface.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to delete arbitrary files with the privileges of the RevPiPyLoad daemon, resulting in loss of configuration integrity and denial of service, by sending crafted requests to the local management service.