KUNBUS RevPi Webstatus authentication bypass remote
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Authentication bypass in RevPi Webstatus via type confusion allows unauthenticated remote access to affected industrial control systems.
KUNBUS RevPi Webstatus versions 2.4.5 and prior contain an authentication bypass vulnerability (CVE-2025-41646) arising from incorrect implementation of the password authentication algorithm. The vulnerability stems from a type-conversion flaw where providing the JSON boolean value TRUE in the password parameter's hashcode field bypasses authentication checks, granting attackers unauthorized access to the application without credentials. The affected device is deployed across critical infrastructure sectors including manufacturing, energy, transportation, and water systems worldwide. KUNBUS has released patched version 2.4.6, available via apt-get update or manual installation. CISA reports no known public exploitation at this time, but the combination of remote exploitability, zero authentication requirements, and network accessibility in industrial deployments makes this a high-priority patch target. Organizations should prioritize updating to version 2.4.6 and implement network segmentation to limit exposure.
Mentioned in this report
Detection guidance
RevPi Webstatus Authentication Bypass Attempt via Boolean Hashcode in Password Parameter
Detects web requests where the logged query or request data carries a password hashcode field set to boolean true, the CVE-2025-41646 auth bypass pattern against KUNBUS RevPi Webstatus. Only fires where the web server, reverse proxy or WAF logs request parameters or JSON content into the query field. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: RevPi Webstatus Authentication Bypass Attempt via Boolean Hashcode in Password
Parameter
id: f918c7af-c030-57f8-8fe8-2b53821bae63
status: experimental
description: Detects web requests where the logged query/parameter data carries a
password hashcode field set to the JSON boolean true, the CVE-2025-41646 type-confusion
authentication bypass against KUNBUS RevPi Webstatus 2.4.5 and prior. Requires a
web server, reverse proxy or WAF that records request parameters or JSON content
in the query field. Standard access logs without request bodies will not see this.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-09
tags:
- attack.initial-access
- attack.t1190
- attack.stealth
- attack.t1078.001
- cve.2025-41646
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains|all:
- hashcode
- password
selection_true:
cs-uri-query|contains:
- hashcode":true
- 'hashcode": true'
- hashcode%22:true
- hashcode%22%3Atrue
- hashcode%22%3A%20true
- hashcode=true
condition: selection_param and selection_true
falsepositives:
- Vulnerability scanners or authorised penetration tests validating CVE-2025-41646
- Custom client applications that legitimately send a boolean field named hashcode
in a password-related parameter
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-09
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs