CVE-2022-35871
Inductive Automation Ignition Missing Authentication for Critical Function Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within the authenticateAdSso method. The issue results from the lack of authentication prior to allowing the execution of python code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17206.
Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de Inductive Automation Ignition versión 8.1.15 (b2022030114). La autenticación no es necesaria para explotar esta vulnerabilidad. El fallo específico se presenta dentro del método authenticateAdSso. El problema resulta de una falta de autenticación antes de permitir la ejecución de código python. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de SYSTEM. Era ZDI-CAN-17206
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the authenticateAdSso method. The issue results from the lack of authentication prior to allowing the execution of python code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-07-14 CVE Reserved
- 2022-07-15 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-16 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://www.zerodayinitiative.com/advisories/ZDI-22-1018 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Inductiveautomation Search vendor "Inductiveautomation" | Ignition Search vendor "Inductiveautomation" for product "Ignition" | 8.1.15 Search vendor "Inductiveautomation" for product "Ignition" and version "8.1.15" | - |
Affected
|