Arbitrary Code Execution Vulnerability in Inductive Automation Ignition
CVE-2022-35872

7.8HIGH

Key Information:

Vendor

Inductive Automation

Status
Ignition
Vendor
CVE Published:
25 July 2022

What is CVE-2022-35872?

This vulnerability in Inductive Automation Ignition 8.1.15 arises from improper validation of user-supplied data during ZIP file parsing, allowing remote attackers to execute arbitrary code. Exploitation requires user interaction, necessitating that the target interacts with a malicious page or file. By leveraging this flaw, an attacker can potentially execute code with SYSTEM privileges, posing significant risks to the integrity of affected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Ignition 8.1.15 (b2022030114)

References

https://support.inductiveautomation.com/hc/en-us/articles...
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-22-1019/
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Piotr Bazydlo (@chudypb)
JSON
.