CVE-2024-41889: Pimax Pitool

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.

Affected products

• Pimax Pitool: affected versions not specified
• Pimax Play: before 1.21.01 (fixed in 1.21.01)

Published 2024-08-05. Last modified 2026-06-17.