CVE-2025-24522 KUNBUS Revolution Pi Authentication Bypass by Primary Weakness

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system...

CVE-2025-24522

CVE-2025-24522 affects KUNBUS Revolution Pi OS Bookworm 01/2025 where Node-RED authentication is not configured by default. An unauthenticated remote attacker can gain full access to the Node-RED server and execute arbitrary OS commands (impacting PLC control). Connected sources describe the root...

KUNBUS Revolution Pi OS Bookworm 安全漏洞

KUNBUS Revolution Pi OS Bookworm is an industrial-grade real-time operating system based on Debian Bookworm from KUNBUS. A security vulnerability exists in KUNBUS Revolution Pi OS Bookworm 01/2025 that stems from the Node-RED server not being configured for authentication by default, which could...

PT-2025-18781 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: IntelR TiberTM Edge Platform Edge Orchestrator versions prior to 24.11.1 Description: A protection mechanism failure exists in some Edge Orchestrator software. An authenticated user may be able to enable a denial of service via adjacent acces...

PT-2025-18691 · Kunbus +1 · Kunbus Revolution Pi Os +1

Name of the Vulnerable Software and Affected Versions: KUNBUS Revolution Pi OS Bookworm 01/2025 Description: The issue arises because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server, where the...

PT-2025-18782 · Undefined · Undefined

@CISAgov 2/8 🏭 Revolution Pi vulnerability details: The industrial IoT platform has THREE critical flaws CVE-2025-24522, CVE-2025-24523, CVE-2025-24524 with CVSS scores up to 10.0! These affect Node-RED and PiCtory components widely used in manufacturing, energy, and water sectors...

Malicious code in node-red-contrib-request (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9732 Malicious code in node-red-contrib-request (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in node-red-contrib-lowwercase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 577092139d0eab16ce212c5f1857a5bd55b8632d4d93358b21d74e379dbf7f60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9242 Malicious code in node-red-contrib-lowwercase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 577092139d0eab16ce212c5f1857a5bd55b8632d4d93358b21d74e379dbf7f60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

D-Link G416 nodered gz file command injection vulnerability

D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 , which supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection vulnerability that stems from a nodered gz file handling command...

D-Link G416 nodered tar file command injection vulnerability

D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 , which supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection vulnerability that stems from a nodered tar file handling command...

D-Link G416 安全漏洞

D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 , which supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection vulnerability that stems from a nodered gz file handling command...

@3c-node-red/runtime (=3.1.6), @adeunis/node-red-contrib-adeunis-codecs (=1.0.0) +244 more potentially affected by CVE-2024-27307 via jsonata (>=1.5.0 <=1.8.6)

jsonata NPM version =1.5.0, =20.2.3, =5.0.0, =0.8.0, =0.0.1, =1.0.0, =1.0.1, =2.0.0, =2.0.4 - @elastic.io/batching-library =2.0.1-dev.4 and more Source cves: CVE-2024-27307 Source advisory: OSV:GHSA-FQG8-VFV7-8FJ8...

Malicious code in node-red-contrib-object-to-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc617e826788805ca870b385151ace964f43893d9560c8b2d9615276520929a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1030 Malicious code in node-red-contrib-object-to-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc617e826788805ca870b385151ace964f43893d9560c8b2d9615276520929a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the nodered function of the D-Link G416 router’s HTTP microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the nodered function of the D-Link G416 router’s HTTP microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by...

VulnCheck KEV: CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file...

The vulnerability of the application programming interface of the graphical programming environment for creating threaded applications, Node-Red, allows a hacker to modify the default JavaScript object prototype.

The vulnerability of the application programming interface of the graphical programming environment for creating threaded applications like Node-Red is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability could allow a...

VulnCheck KEV: CVE-2021-3223

Node-RED-Dashboard before 2.26.2 allows uibase/js/..%2f directory traversal to read files...