CVE-2023-45796 Overview
CVE-2023-45796 is a stored cross-site scripting (XSS) vulnerability in the Runtime component of Pilz PASvisu before version 1.14.1 and Pilz PMI v8xx up to and including version 2.0.33992. The flaw allows a low-privileged remote attacker to inject persistent script payloads that manipulate process data rendered by the visualization runtime. Successful exploitation impacts the integrity and availability of industrial process data presented to operators. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers can inject persistent scripts into the PASvisu Runtime, altering displayed process data and disrupting operator visibility into industrial control systems.
Affected Products
- Pilz PASvisu versions prior to 1.14.1
- Pilz PMI v8xx versions up to and including 2.0.33992
- PASvisu Runtime component (visualization layer)
Discovery Timeline
- 2026-06-22 - CVE-2023-45796 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2023-45796
Vulnerability Analysis
The vulnerability resides in the Runtime component of Pilz PASvisu, a visualization platform used in industrial automation deployments. The Runtime fails to properly neutralize user-supplied input before storing and rendering it within the web-facing visualization interface. An attacker with low privileges can submit crafted input that the application persists and later returns to other users without sanitization.
When an operator or engineer loads the affected visualization view, the stored payload executes in the context of their browser session. The script can then manipulate process data values displayed by the human-machine interface (HMI), interfere with control workflows, and degrade availability of the visualization. In operational technology (OT) environments, falsified HMI data can cause operators to take incorrect actions based on misleading process state.
Root Cause
The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. The PASvisu Runtime accepts attacker-controlled content through one or more input fields and stores it without applying output encoding or contextual escaping. When the data is later embedded into the rendered HTML response, the browser interprets it as executable script rather than inert data.
Attack Vector
Exploitation occurs over the network against the PASvisu Runtime web interface. An authenticated low-privileged user submits a payload containing JavaScript through an input vector that the runtime persists. The payload triggers when any subsequent user loads the affected view, requiring no further user interaction. See the CERT-VDE Security Advisory for vendor-specific technical detail.
Detection Methods for CVE-2023-45796
Indicators of Compromise
- Unexpected <script> tags, JavaScript event handlers, or HTML entities stored in PASvisu project files and runtime databases
- Anomalous outbound connections from operator workstations after loading visualization views
- Process data values in the HMI that do not match controller-reported values
Detection Strategies
- Inspect stored PASvisu Runtime content for HTML or JavaScript markup in fields expected to contain only numeric or label data
- Review web server access logs for POST requests containing script tags, javascript: URIs, or encoded payloads targeting PASvisu endpoints
- Compare HMI-displayed process values against authoritative PLC tag values to identify integrity drift
Monitoring Recommendations
- Monitor authentication logs for low-privileged accounts performing write operations against the PASvisu Runtime
- Alert on browser-side script errors or content security policy violations originating from PASvisu visualization pages
- Track configuration changes to PASvisu project files and correlate with user activity
How to Mitigate CVE-2023-45796
Immediate Actions Required
- Upgrade Pilz PASvisu to version 1.14.1 or later
- Upgrade Pilz PMI v8xx to a version newer than 2.0.33992 as published by Pilz
- Restrict network access to the PASvisu Runtime interface to trusted engineering workstations and operator HMIs only
- Audit existing PASvisu project content for previously injected payloads before resuming production use
Patch Information
Pilz addresses the vulnerability in PASvisu 1.14.1 and corresponding PMI v8xx firmware releases. Refer to the CERT-VDE Security Advisory VDE-2023-050 for the authoritative list of fixed versions and download instructions from the vendor.
Workarounds
- Place PASvisu and PMI devices on isolated OT network segments with strict firewall rules limiting inbound HTTP/HTTPS traffic
- Require multi-factor authentication on jump hosts used to access the visualization runtime
- Enforce least-privilege account assignment so that only required engineering accounts can write to PASvisu project data
- Use browser-based content security policies on operator workstations to block inline script execution where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
