Remote Code Execution Vulnerability in Inductive Automation Ignition
CVE-2023-50222

8.8HIGH

Key Information:

Vendor

Inductive Automation

Status
Ignition
Vendor
CVE Published:
3 May 2024

What is CVE-2023-50222?

This vulnerability within the Inductive Automation Ignition platform occurs in the ResponseParser method, where insufficient validation of user-supplied data can lead to deserialization of untrusted input. As a result, remote attackers may exploit this flaw to execute arbitrary code in the context of the affected user. To exploit this vulnerability, user interaction is required; specifically, the user must connect to a malicious server. It is essential for users of the affected product to remain vigilant and implement recommended security practices.

Affected Version(s)

Ignition 8.1.31

References

https://www.zerodayinitiative.com/advisories/ZDI-24-017/
x_research-advisory
https://security.inductiveautomation.com/?tcuUid=fc4c4515...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.