CVE-2023-45796: Stored XSS in Pilz PASvisu & PMI Industrial Software – Remediation Guide

Technical summary

CVE-2023-45796 is a stored XSS vulnerability (CWE-79) in the Runtime component of Pilz PASvisu versions before 1.14.1 and PMI v8xx series up to version 2.0.33992. The flaw permits a low-privileged remote attacker to inject and persist malicious scripts that execute in the context of other users' sessions. The attack vector is network-based with no user interaction required from the victim, though the attacker must possess valid (low-level) credentials. The vulnerability impacts data integrity and availability, scoring 8.1 under CVSS v3.1 (HIGH severity).

Business impact

In industrial settings, this vulnerability creates a direct path to process manipulation without administrative access. An attacker with basic user credentials can corrupt or falsify manufacturing data, interfere with control logic execution, or trigger unintended state changes that affect production output, quality, or safety. Unlike remote code execution, stored XSS in industrial systems often goes undetected longer because the malicious activity appears to originate from legitimate system users. The integrity and availability impacts make this a critical concern for facilities relying on PASvisu or PMI for process oversight.

Affected systems

Pilz PASvisu versions prior to 1.14.1 are vulnerable. Pilz PMI v8xx series through version 2.0.33992 is affected. Both products are widely used in industrial automation, robotics, and safety systems. Organizations should inventory deployments and determine version status immediately. Verify specific build or patch levels against Pilz vendor advisories.

Exploitability

Exploitability is straightforward: the attack requires only network access and valid low-privilege credentials (such as a read-only operator account). No social engineering, client-side manipulation, or zero-click techniques are necessary. The attacker can store the payload once and compromise all subsequent users who interact with affected data. This low barrier to exploitation, combined with the attack's stealth characteristics in industrial environments, elevates practical risk despite the requirement for authenticated access.

Remediation

Upgrade Pilz PASvisu to version 1.14.1 or later. Update PMI v8xx to a patched version beyond 2.0.33992. Verify the specific patch version and build number in the vendor advisory before deployment. Organizations unable to patch immediately should implement compensating controls: restrict low-privilege user account creation, enforce network segmentation to limit Runtime component access, monitor for unusual data modifications, and disable unused accounts.

Patch guidance

Obtain and deploy the latest PASvisu and PMI releases from Pilz. Verify patch versions match those documented in official vendor security advisories before installation. Test patches in a non-production environment that mirrors your operational setup, particularly if PMI is integrated with critical control logic. Coordinate patching with scheduled maintenance windows to minimize production disruption. Validate that stored data integrity is maintained post-patch.

Detection guidance

Monitor Runtime component logs for unexpected script tags or encoded payloads in process data fields and configuration parameters. Look for suspicious stored values that contain HTML, JavaScript, or encoded content in normally alphanumeric fields. Correlate data modification logs with user session records, flagging cases where low-privilege accounts trigger unusual updates. Deploy Web Application Firewalls (WAFs) if the Runtime component exposes web interfaces. Regular data integrity checks and anomaly detection on process parameters can surface injected content before it executes.

Why prioritize this

This vulnerability merits urgent attention because it bridges the gap between low-privileged access and process manipulation in operational technology. In OT environments, data integrity is often treated as equivalent to availability and safety—tampering can have cascading effects. The low attack complexity, lack of user interaction requirement, and high integrity/availability impact combine to create substantial operational risk. The fact that it is not yet in CISA's KEV catalog does not diminish the threat; it reflects the specialized nature of industrial systems. Organizations running Pilz products should treat this as a near-term priority.

Risk score, explained

The CVSS 8.1 HIGH score reflects the combination of network accessibility, low attack complexity, the requirement for low-privilege credentials (versus none), and the high impact on integrity and availability. The absence of confidentiality impact caps the score below CRITICAL, but the ability to manipulate process data without administrative rights makes this a significant operational security issue in industrial environments. The score appropriately signals that this is not a theoretical concern but a practical exploitation pathway.

Frequently asked questions