CVE-2025-36558 Overview
CVE-2025-36558 is a reflected cross-site scripting (XSS) vulnerability in KUNBUS PiCtory version 2.11.1 and earlier. The flaw resides in the sso_token parameter used for authentication. An attacker who crafts a PiCtory URL containing HTML script content inside the sso_token value can cause that script to execute in the victim's browser when the URL is opened. PiCtory is the configuration tool for KUNBUS Revolution Pi industrial controllers, placing the flaw within an operational technology (OT) context. The vulnerability is tracked under CWE-97 (Improper Neutralization of Server-Side Includes within a Web Page) and is documented in CISA ICS Advisory ICSA-25-121-01.
Critical Impact
A crafted PiCtory URL executes attacker-supplied JavaScript in the victim's browser session, enabling theft of the sso_token, session hijack, and arbitrary actions against Revolution Pi configuration interfaces.
Affected Products
- KUNBUS PiCtory 2.11.1
- All KUNBUS PiCtory versions prior to 2.11.1
- KUNBUS Revolution Pi devices bundling affected PiCtory builds
Discovery Timeline
- 2025-05-01 - CVE-2025-36558 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36558
Vulnerability Analysis
The vulnerability is a reflected XSS in the PiCtory web interface. PiCtory accepts an sso_token query parameter to authenticate incoming users through single sign-on. The application reflects the value of sso_token back into the HTTP response without sufficient neutralization of HTML or script content. When a victim visits a link supplied by the attacker, the browser parses the reflected content as executable script rather than as an opaque authentication token.
Because PiCtory runs on Revolution Pi controllers used in industrial automation, execution occurs within the origin of the device's management interface. Successful exploitation lets the attacker read authenticated context, manipulate the configuration DOM, submit forms on the user's behalf, or exfiltrate the legitimate sso_token for reuse.
Exploitation requires user interaction: the target must click or otherwise load the malicious PiCtory URL. No prior authentication or privileges are required from the attacker to craft the payload.
Root Cause
The root cause is a lack of output encoding on the sso_token parameter. Authentication tokens should be treated as opaque, validated against a strict character set (for example, base64url), and never reflected into HTML response bodies. PiCtory instead echoes the raw value into a location where the browser interprets it as markup, satisfying the conditions for [CWE-97].
Attack Vector
The attack vector is network-based and user-assisted. An attacker constructs a URL such as http://<pi-host>/pictory/?sso_token=<script>...</script> and delivers it via phishing email, chat, or a compromised web page. When an operator or engineer with access to the Revolution Pi opens the link, the injected script runs in the security context of the PiCtory application. Refer to the CISA ICS Advisory ICSA-25-121-01 and the Revolution Pi package repository for vendor-specific technical detail.
No public proof-of-concept is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. The EPSS score at the time of writing places the CVE in the upper percentile relative to other published CVEs, indicating elevated interest.
Detection Methods for CVE-2025-36558
Indicators of Compromise
- HTTP requests to PiCtory endpoints containing sso_token values with <script>, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
- Referrer headers indicating that a Revolution Pi web interface was loaded from an external, untrusted domain.
- Outbound connections from operator workstations to unfamiliar hosts immediately after a PiCtory session.
- Unexpected changes to Revolution Pi configuration performed under a legitimate operator account.
Detection Strategies
- Inspect web server and reverse-proxy logs for sso_token query values that contain HTML tag characters or encoded script payloads.
- Deploy a Web Application Firewall (WAF) rule set that flags XSS signatures on any request path serving PiCtory.
- Correlate browser telemetry from engineering workstations with PiCtory URL access to identify script execution from reflected parameters.
- Alert on PiCtory sessions initiated from off-network referrers or non-standard user agents.
Monitoring Recommendations
- Forward PiCtory HTTP access logs to a centralized SIEM or data lake for retention and query.
- Baseline normal sso_token length and character set, then alert on outliers.
- Monitor egress from OT engineering VLANs for connections to attacker-controlled infrastructure that could receive exfiltrated tokens.
How to Mitigate CVE-2025-36558
Immediate Actions Required
- Upgrade KUNBUS PiCtory to a version later than 2.11.1 as published in the Revolution Pi package repository.
- Restrict access to PiCtory management interfaces to trusted engineering hosts on segmented OT networks.
- Instruct operators not to open PiCtory URLs delivered through email, messaging, or external web pages.
- Review recent PiCtory access logs for sso_token values containing script syntax.
Patch Information
KUNBUS distributes fixed PiCtory packages through the Revolution Pi package repository. Apply the vendor-supplied update on every Revolution Pi device running PiCtory 2.11.1 or earlier. Follow the remediation steps published in CISA ICS Advisory ICSA-25-121-01.
Workarounds
- Place PiCtory behind a reverse proxy that strips or validates the sso_token parameter against a strict allowlist of characters.
- Enforce a Content Security Policy (CSP) header on responses from PiCtory to block inline script execution.
- Disable or restrict remote access to PiCtory until patched builds are deployed.
- Require operators to access PiCtory through a hardened jump host without general internet browsing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
