CVE-2023-50218: falha de alta gravidade em Inductive Automation Ignition
Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 55%
Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.
The specific flaw exists within the ModuleInvoke class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21624.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Inductive Automation · IgnitionCVEs relacionadas — Inductive Automation Ignition
No mesmo produto, das mais perigosas para as menos.
CVE-2023-39475CRITICALInductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 64.1%CVE-2023-39473HIGHInductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 62.5%CVE-2022-35869HIGHCVE-2022-35869EPSS 59.9%CVE-2023-38124HIGHInductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution VulnerabilityEPSS 59.6%CVE-2023-50223HIGHInductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 54.9%CVE-2022-35870HIGHCVE-2022-35870EPSS 44.3%