CVE-2020-10644

HIGH

Ignition <8.0.10, <7.9.14 - Info Disclosure

Title source: llm

Description

The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.

Exploits (1)

metasploit WORKING POC EXCELLENT

rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/scada/inductive_ignition_rce.rb

View Code ZIP pw:eip

References (2)

[Third Party Advisory, US Government Resource] https://www.us-cert.gov/ics/advisories/icsa-20-147-01

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/158226/Inductive-Automation-Ignition-Remote-Code-Execution.html

Scores

CVSS v3 7.5

EPSS 0.2089

EPSS Percentile 95.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-502

Status published

Affected Products (1)

inductiveautomation/ignition_gateway < 7.9.14

Timeline

Published Jun 09, 2020

Tracked Since Feb 18, 2026