Remote Code Execution Flaw in Inductive Automation Ignition
CVE-2022-35871

8.1HIGH

Key Information:

Vendor

Inductive Automation

Status
Ignition
Vendor
CVE Published:
25 July 2022

What is CVE-2022-35871?

This vulnerability poses a significant risk as it enables remote attackers to execute arbitrary code on installations of Inductive Automation Ignition 8.1.15 without any authentication. The flaw lies in the authenticateAdSso method, where the absence of proper authentication checks permits unauthorized execution of Python code. Consequently, attackers can exploit this weakness to run code with SYSTEM privileges, thereby compromising the integrity and security of the affected systems. This concern has been documented in advisories including ZDI-CAN-17206.

Affected Version(s)

Ignition 8.1.15 (b2022030114)

References

https://support.inductiveautomation.com/hc/en-us/articles...
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-22-1018/
x_refsource_MISC

EPSS Score

28% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daan Keuper & Thijs Alkemade from Computest
JSON
.