CVE-2023-45795: XSS in Pilz PASvisu Builder Component – Patch Guidance

Technical summary

The vulnerability is a stored or reflected XSS flaw (CWE-79) in the Builder Component of Pilz PASvisu. The attack vector is local (AV:L), requires no special privileges (PR:N), and relies on user interaction (UI:R) to execute—such as opening a malicious project file or clicking a crafted link within the application. Once triggered, the injected JavaScript runs with the privileges of the PASvisu application, allowing full compromise including information disclosure, integrity violation, and potential denial of service. The low attack complexity (AC:L) means the exploit does not require specialized conditions or timing.

Business impact

Compromise of a PASvisu device can disrupt critical industrial automation processes. An attacker with full device control could manipulate safety-critical logic, alter production parameters, exfiltrate configuration or operational data, or disable monitoring and logging. In manufacturing or process control settings, this could lead to equipment damage, production stoppages, safety hazards, or regulatory violations. The local attack requirement limits exposure in typical network-only scenarios, but sites with shared workstations, removable media, or co-located development environments face elevated risk.

Affected systems

Pilz PASvisu versions prior to 1.14.1 are affected. Verify your installed version against Pilz's official advisory to confirm exposure. Organizations using PASvisu for ladder logic programming, visualization, or device configuration in industrial control systems should assess their deployment footprint and patch readiness.

Exploitability

Exploitation requires local access and user interaction—an attacker must persuade a user to open a malicious file or follow a crafted link within the PASvisu Builder Component. The vulnerability is not remotely exploitable over the network in its current form. However, the low barrier to exploitation once access is achieved, combined with the severity of the impact, makes this a material risk in environments where local access is possible or where social engineering could succeed. The vulnerability is not currently listed in the KEV catalog.

Remediation

Upgrade Pilz PASvisu to version 1.14.1 or later. This patch addresses the XSS flaw in the Builder Component. Before patching, restrict local access to PASvisu workstations, enforce principle of least privilege for users who must interact with the application, and educate staff not to open untrusted project files or click suspicious links within the tool.

Patch guidance

Contact Pilz or consult their official product advisories to obtain and deploy PASvisu 1.14.1 or newer. Verify the patch version against Pilz's release notes to ensure the XSS vulnerability is resolved. Plan patching in a maintenance window that accounts for any dependencies or integrations with your automation infrastructure. Consider a staged rollout to validate compatibility with existing projects and configurations before full deployment.

Detection guidance

Monitor PASvisu logs and the underlying system for signs of JavaScript injection or unexpected script execution during Builder Component operations. Look for: unusual project file modifications, unexpected JavaScript errors or warnings in the application, anomalous child process spawning from PASvisu, or changes to device configurations without authorized user action. Network-level detection is limited due to the local attack vector, but file integrity monitoring on PASvisu project files and configuration backups can help identify tampering.

Why prioritize this

This vulnerability warrants prompt attention due to its HIGH severity rating (CVSS 7.8), the potential for full device compromise, and the critical role PASvisu plays in industrial automation. Although the local attack requirement and need for user interaction reduce immediate remote risk, organizations relying on PASvisu should prioritize patching within standard update cycles—typically 30 to 90 days depending on operational constraints. The absence from the KEV catalog suggests limited active exploitation to date, but this should not delay remediation.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH-severity vulnerability. The score accounts for: (1) local attack surface (AV:L), reducing network-based risk but not eliminating it for multi-user or development environments; (2) low attack complexity (AC:L), meaning no specialized techniques are required; (3) no privileges required (PR:N), allowing any local user to attempt exploitation; (4) user interaction required (UI:R), as the attack relies on social engineering or tricking a user; and (5) high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), as successful exploitation grants full device control. The scope is unchanged (S:U), meaning the impact is confined to the vulnerable component.

Frequently asked questions