# KUNBUS RevPi Webstatus authentication bypass remote

Published: 2025-07-10 · Severity: elevated · Sectors: manufacturing, energy, transportation, infrastructure
Canonical: https://vorant.io/reports/3fd889b9-d396-569c-9147-48a00141c630/kunbus-revpi-webstatus-authentication-bypass-remote

> Authentication bypass in RevPi Webstatus via type confusion allows unauthenticated remote access to affected industrial control systems.

KUNBUS RevPi Webstatus versions 2.4.5 and prior contain an authentication bypass vulnerability (CVE-2025-41646) arising from incorrect implementation of the password authentication algorithm. The vulnerability stems from a type-conversion flaw where providing the JSON boolean value TRUE in the password parameter's hashcode field bypasses authentication checks, granting attackers unauthorized access to the application without credentials. The affected device is deployed across critical infrastructure sectors including manufacturing, energy, transportation, and water systems worldwide. KUNBUS has released patched version 2.4.6, available via apt-get update or manual installation. CISA reports no known public exploitation at this time, but the combination of remote exploitability, zero authentication requirements, and network accessibility in industrial deployments makes this a high-priority patch target. Organizations should prioritize updating to version 2.4.6 and implement network segmentation to limit exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2025-41646 (templated)

## Detection guidance (public sample)

### RevPi Webstatus Authentication Bypass Attempt via Boolean Hashcode in Password Parameter

ATT&CK: T1190

Detects web requests where the logged query or request data carries a password hashcode field set to boolean true, the CVE-2025-41646 auth bypass pattern against KUNBUS RevPi Webstatus. Only fires where the web server, reverse proxy or WAF logs request parameters or JSON content into the query field. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RevPi Webstatus Authentication Bypass Attempt via Boolean Hashcode in Password
  Parameter
id: f918c7af-c030-57f8-8fe8-2b53821bae63
status: experimental
description: Detects web requests where the logged query/parameter data carries a
  password hashcode field set to the JSON boolean true, the CVE-2025-41646 type-confusion
  authentication bypass against KUNBUS RevPi Webstatus 2.4.5 and prior. Requires a
  web server, reverse proxy or WAF that records request parameters or JSON content
  in the query field. Standard access logs without request bodies will not see this.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-09
tags:
- attack.initial-access
- attack.t1190
- attack.stealth
- attack.t1078.001
- cve.2025-41646
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains|all:
    - hashcode
    - password
  selection_true:
    cs-uri-query|contains:
    - hashcode":true
    - 'hashcode": true'
    - hashcode%22:true
    - hashcode%22%3Atrue
    - hashcode%22%3A%20true
    - hashcode=true
  condition: selection_param and selection_true
falsepositives:
- Vulnerability scanners or authorised penetration tests validating CVE-2025-41646
- Custom client applications that legitimately send a boolean field named hashcode
  in a password-related parameter
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-09

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3fd889b9-d396-569c-9147-48a00141c630/kunbus-revpi-webstatus-authentication-bypass-remote.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup