CVE-2025-24522: Revolution Pi OS Authentication Bypass

CVE-2025-24522 Overview

CVE-2025-24522 is a critical authentication bypass vulnerability affecting KUNBUS Revolution Pi OS Bookworm 01/2025. The vulnerability exists because authentication is not configured by default for the Node-RED server, allowing unauthenticated remote attackers to gain full access to the Node-RED server interface. Once access is obtained, attackers can execute arbitrary commands on the underlying operating system, potentially leading to complete system compromise.

Critical Impact
Unauthenticated remote attackers can gain full control of industrial control systems running the affected Revolution Pi OS by exploiting the missing authentication on Node-RED servers, enabling arbitrary command execution on the underlying operating system.

Affected Products

KUNBUS Revolution Pi OS Bookworm 01/2025
Node-RED server instances on affected Revolution Pi devices
Industrial control systems utilizing Revolution Pi hardware

Discovery Timeline

May 1, 2025 - CVE-2025-24522 published to NVD
May 2, 2025 - Last updated in NVD database

Technical Details for CVE-2025-24522

Vulnerability Analysis

This vulnerability represents an insecure default configuration issue classified under CWE-305 (Authentication Bypass by Primary Weakness). The core problem stems from the Node-RED server being deployed without authentication enabled by default in the Revolution Pi OS Bookworm 01/2025 distribution.

Node-RED is a flow-based programming tool commonly used in industrial and IoT environments for connecting hardware devices, APIs, and online services. When authentication is not configured, the Node-RED editor and runtime are accessible to anyone who can reach the server over the network. The Node-RED platform includes functionality to execute system commands through the exec node, meaning an attacker with access to the editor can create flows that run arbitrary commands with the privileges of the Node-RED process.

Given that Revolution Pi devices are often deployed in industrial control system (ICS) environments, exploitation of this vulnerability could have severe consequences for operational technology (OT) infrastructure. CISA has issued an ICS Advisory ICSA-25-121-01 regarding this vulnerability.

Root Cause

The root cause is an insecure default configuration where the Node-RED server is installed and started without requiring authentication. This design flaw violates the security principle of secure defaults, leaving devices exposed immediately upon deployment. The Node-RED server's settings.js configuration file does not have the adminAuth property configured by default, allowing anonymous access to all server functions including flow editing and command execution capabilities.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker simply needs network access to the Node-RED server port (typically TCP port 1880) to exploit this vulnerability. The attack flow typically involves:

Scanning the network for exposed Node-RED instances on the default port
Accessing the Node-RED editor interface without credentials
Deploying a malicious flow containing an exec node
Executing arbitrary commands on the underlying Revolution Pi operating system

The vulnerability can be exploited remotely by any attacker who can reach the Node-RED port. In ICS environments, this may include attackers who have compromised perimeter defenses or malicious insiders with network access.

Detection Methods for CVE-2025-24522

Indicators of Compromise

Unexpected network connections to Node-RED server port (TCP 1880)
New or modified flows in Node-RED containing exec nodes or other system command capabilities
Unauthorized processes spawned by the Node-RED service
Suspicious commands executed with Node-RED service account privileges
Anomalous outbound connections from Revolution Pi devices

Detection Strategies

Monitor network traffic for connections to TCP port 1880 from unauthorized sources
Implement intrusion detection rules for Node-RED exploitation patterns
Audit Node-RED flow configurations for unauthorized exec nodes or suspicious flows
Review process creation events for commands spawned by the Node-RED process
Deploy network segmentation monitoring to detect lateral movement from compromised devices

Monitoring Recommendations

Enable logging for Node-RED server access and flow deployments
Implement network traffic analysis for ICS/OT network segments containing Revolution Pi devices
Configure SIEM alerts for authentication failures or unexpected access patterns
Monitor system calls and process execution on Revolution Pi devices
Establish baseline behavior for Node-RED servers and alert on deviations

How to Mitigate CVE-2025-24522

Immediate Actions Required

Enable authentication on all Node-RED server instances immediately
Restrict network access to Node-RED ports using firewall rules
Segment Revolution Pi devices from untrusted networks
Audit existing Node-RED flows for malicious or unauthorized content
Review system logs for signs of prior exploitation

Patch Information

KUNBUS has made updated packages available through their Pictory Package Repository. Organizations should update to the latest available version that addresses this security issue. Refer to the CISA ICS Advisory ICSA-25-121-01 for official vendor guidance and patch details.

Workarounds

Configure Node-RED authentication by editing the settings.js file to enable the adminAuth property
Implement network-level access controls to restrict access to the Node-RED port
Deploy a reverse proxy with authentication in front of the Node-RED server
Disable the Node-RED service if not required for operations
Implement network segmentation to isolate affected devices from untrusted networks

bash

# Configuration example for enabling Node-RED authentication
# Edit /home/pi/.node-red/settings.js and add:
adminAuth: {
    type: "credentials",
    users: [{
        username: "admin",
        password: "<bcrypt-hashed-password>",
        permissions: "*"
    }]
}

# Generate bcrypt password hash using node-red-admin:
# npx node-red-admin hash-pw

# Restart Node-RED service after configuration:
sudo systemctl restart nodered