CVE-2025-41646

The vulnerability stems from incorrect type conversion (CWE-704) in the authentication logic of the software. A remote attacker without any privileges can exploit this flaw to bypass identity verification and gain unauthorized access to the device. The attack requires no user interaction or special network conditions — network access to the vulnerable system is sufficient.

The attacker gains full, unauthorized access to the device, resulting in a breach of confidentiality, integrity, and availability — a complete compromise of the system.

Apply patches available from the manufacturer according to the references (https://www.kunbus.com/en/productsecurity/Kunbus-2025-0000003). Until the fix is implemented, it is recommended to restrict network access to RevPi Status devices through network segmentation or a firewall.

Kunbus RevPi Status — versions indicated in the manufacturer's references