CVE-2022-35871

HIGH

inductiveautomation Ignition Missing Authentication for Critical Function

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2022-35871 has a selected CVSS score of 7.8 (high).

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within the authenticateAdSso method. The issue results from the lack of authentication prior to allowing the execution of python code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17206.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 20, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Affected products and versions

1
ProductSourceVersion range

Ignition

Browse Inductive Automation / Ignition
CVE List, VulnCheck8.1.15 (b2022030114)affected

References

3