CVE-2022-40977: Pilz Pasvisu

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

Affected products

• Pilz Pasvisu: before 1.12.0 (fixed in 1.12.0)
• Pilz Pmi v507 Firmware: up to and including 1.3.58
• Pilz Pmi v512 Firmware: up to and including 1.3.58
• Pilz Pmi v704e Firmware: before 2.2.0 (fixed in 2.2.0)
• Pilz Pmi v707e Firmware: before 2.2.0 (fixed in 2.2.0)
• Pilz Pmi v807 Firmware: before 1.6.102 (fixed in 1.6.102)
• Pilz Pmi v812 Firmware: before 1.6.102 (fixed in 1.6.102)
• Pilz Pmi v815 Firmware: before 1.6.102 (fixed in 1.6.102)

Published 2022-11-24. Last modified 2026-06-17.