Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability

CVE-2023-38122

What is CVE-2023-38122?

A vulnerability has been identified in the Inductive Automation Ignition OPC UA Quick Client which permits remote attackers to execute arbitrary code. This exploits a misconfiguration within the web server related to Content Security Policy headers. Although the exploit requires authentication, the existing measures can be circumvented, providing a pathway for code execution within the SYSTEM context. The potential for this vulnerability to be leveraged in combination with other weaknesses poses significant security risks.

References