PT-2022-23000 · Inductive Automation · Inductive Automation Ignition

Published 2022-07-15 · Updated 2022-07-21 · CVE-2022-35890

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition versions 7.9.19 and earlier, 8.x versions prior to 8.1.17

Description An issue was discovered where Designer and Vision Client Session IDs are mishandled, allowing an attacker to determine which session IDs were generated in the past and then hijack sessions assigned to these IDs.

Recommendations For Inductive Automation Ignition versions 7.9.19 and earlier, update to version 7.9.20 or later. For Inductive Automation Ignition 8.x versions prior to 8.1.17, update to version 8.1.17 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-35890

Affected Products

Inductive Automation Ignition

References · 5

• 🔥 https://github.com/sourceincite/randy · Exploit
• https://support.inductiveautomation.com/hc/en-us/articles/7625759776653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35890 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35890 · Vendor Advisory
• https://t.me/cibsecurity/46377 · Telegram Post