CVE-2023-45795 Overview
CVE-2023-45795 is a cross-site scripting (XSS) vulnerability affecting the Builder Component of Pilz PASvisu versions before 1.14.1. The flaw allows a local unauthenticated attacker to inject malicious JavaScript into the Builder Component. Successful exploitation grants the attacker full control over the affected device. The vulnerability is classified under CWE-79, which covers improper neutralization of input during web page generation. Exploitation requires user interaction but no privileges, making it relevant for engineering workstations running PASvisu. Pilz develops PASvisu as a visualization platform used in industrial automation environments, where compromise can impact operational technology systems.
Critical Impact
A local unauthenticated attacker can inject JavaScript through the Builder Component and gain full control over the device, compromising confidentiality, integrity, and availability.
Affected Products
- Pilz PASvisu Builder Component versions prior to 1.14.1
- Engineering workstations running vulnerable PASvisu installations
- Industrial automation systems relying on PASvisu visualization projects
Discovery Timeline
- 2026-06-22 - CVE-2023-45795 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2023-45795
Vulnerability Analysis
The vulnerability resides in the Builder Component of Pilz PASvisu, the design environment used to author visualization projects. The component fails to properly neutralize user-supplied input rendered in the web-based interface. An attacker who can supply a crafted project file or input field can embed JavaScript that executes in the context of the Builder.
Because the Builder runs locally on an engineering workstation with the privileges of the logged-in user, executed script can interact with operating system resources accessible to that user. The Pilz advisory states the impact extends to full device control, indicating that script execution can pivot beyond the browser sandbox into the host application context.
The attack requires user interaction, such as opening a malicious project file in the Builder. No authentication is required to deliver the payload, since the vulnerability is triggered through file or input handling rather than an authenticated session.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The Builder Component renders untrusted content without sufficient output encoding or input sanitization. JavaScript supplied through project data is interpreted by the rendering engine instead of being treated as inert text.
Attack Vector
An attacker crafts a PASvisu project or input containing malicious JavaScript. The attacker delivers the project to a target operator through phishing, shared network locations, or supply chain channels. When the operator opens the project in the Builder Component, the script executes and can perform actions on behalf of the user, including modifying project files, exfiltrating data, or executing host commands available through the application context.
For technical specifics, consult the CERT@VDE Advisory VDE-2023-050.
Detection Methods for CVE-2023-45795
Indicators of Compromise
- PASvisu project files containing inline <script> tags or javascript: URIs in property fields
- Unexpected outbound network connections from engineering workstations running the Builder Component
- Modifications to PASvisu project files originating from untrusted sources or external email attachments
Detection Strategies
- Inventory all engineering workstations running PASvisu and identify versions earlier than 1.14.1
- Inspect project files for embedded scripting content prior to opening them in the Builder
- Correlate file open events for PASvisu artifacts with subsequent process creation or network activity
Monitoring Recommendations
- Log process execution and child processes spawned by the PASvisu Builder application
- Monitor file integrity for project directories and engineering shares
- Alert on PASvisu installations communicating with unexpected external hosts
How to Mitigate CVE-2023-45795
Immediate Actions Required
- Upgrade Pilz PASvisu to version 1.14.1 or later on all engineering workstations
- Restrict the sources from which operators open PASvisu project files to trusted internal repositories
- Apply application allowlisting on operational technology workstations to limit unauthorized execution paths
Patch Information
Pilz addressed the vulnerability in PASvisu version 1.14.1. Refer to the CERT@VDE Advisory VDE-2023-050 for vendor-supplied remediation guidance and download instructions.
Workarounds
- Do not open PASvisu project files received from untrusted or external sources until the patch is applied
- Segment engineering workstations from general-purpose corporate networks to reduce delivery paths
- Enforce least privilege on accounts running the Builder Component to limit the impact of script execution
# Verify installed PASvisu version on Windows engineering workstations
wmic product where "Name like 'PASvisu%%'" get Name,Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
