CVE-2022-1704: high-severity vulnerability in Inductive Automation Ignition
Inductive Automation Ignition
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 1.0%
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Affected products
Inductive Automation · IgnitionRelated CVEs — Inductive Automation Ignition
In the same product, most dangerous first.
CVE-2023-39475CRITICALInductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 64.1%CVE-2023-39473HIGHInductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 62.5%CVE-2022-35869HIGHCVE-2022-35869EPSS 59.9%CVE-2023-38124HIGHInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 59.6%CVE-2023-50218HIGHInductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.0%CVE-2023-50223HIGHInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 54.9%