CVE-2022-35873: high-severity vulnerability in Inductive Automation Ignition
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.7%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of ZIP files. Crafted data in a ZIP file can cause the application to execute arbitrary Python scripts. The user interface fails to provide sufficient indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16949.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Inductive Automation · IgnitionRelated CVEs — Inductive Automation Ignition
In the same product, most dangerous first.
CVE-2023-39475CRITICALInductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 64.1%CVE-2023-39473HIGHInductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 62.5%CVE-2022-35869HIGHCVE-2022-35869EPSS 59.9%CVE-2023-38124HIGHInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 59.6%CVE-2023-50218HIGHInductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 55.0%CVE-2023-50223HIGHInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 54.9%