Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in KUNBUS RevPiPyLoad version 0.11.0. The flaw exists in the XML-RPC management interface's file management functionality, enabling a local unauthenticated attacker to read arbitrary files accessible by the RevPiPyLoad daemon. Exploitation requires local access to the management service and does not require user interaction or elevated privileges beyond those of the daemon. The vulnerability could lead to disclosure of sensitive configuration and credential files.

An attacker with local access to the RevPiPyLoad management interface can read arbitrary files with the daemon's privileges. This may expose sensitive configuration data and credentials, potentially compromising the system's security posture. There is no indication of remote exploitation or privilege escalation beyond the daemon's level. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to the RevPiPyLoad management interface to trusted users only. Monitor for vendor updates or official patches addressing this vulnerability.