An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.
An error classified as CWE-704 (improper type conversion) in the web application authentication mechanism allows an attacker to bypass the login process. The attack requires no privileges, user interaction, or special network conditions — network access to the device's web interface is sufficient. After successfully bypassing login, the attacker gains unrestricted access to the administration panel.
An attacker can read and modify all available IndustrialPI device settings, which in an industrial environment can lead to process disruption, loss of configuration confidentiality, and violation of system integrity and availability.
Apply patches available from the manufacturer according to the references (VDE-2025-039 guide). Until the fix is implemented, it is recommended to restrict network access to the IndustrialPI web interface exclusively to trusted hosts and to segment the industrial network.
IndustrialPI devices — specific versions indicated in the manufacturer's references (VDE-2025-039 guide available at certvde.com)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H