PT-2022-23213 · Inductive Automation · Inductive Automation Ignition

Chris Anastasio + 3 · Published 2022-07-16 · Updated 2022-07-23 · CVE-2022-36126

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition versions 7.9.20 and earlier Inductive Automation Ignition versions 8.1.17 and earlier

Description An issue was discovered in Inductive Automation Ignition that allows remote attackers to execute arbitrary code by supplying a Python script using the ScriptInvoke function.

Recommendations For Inductive Automation Ignition versions 7.9.20 and earlier, update to version 7.9.20 or later. For Inductive Automation Ignition versions 8.1.17 and earlier, update to version 8.1.17 or later. As a temporary workaround, consider disabling the ScriptInvoke function until a patch is available.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-36126

Affected Products

Inductive Automation Ignition

References · 8

• 🔥 https://github.com/sourceincite/randy · Exploit
• https://support.inductiveautomation.com/hc/en-us/articles/7625759776653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36126 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36126 · Vendor Advisory
• https://t.me/cvenotify/33647 · Telegram Post
• https://t.me/cvenotify/33220 · Telegram Post
• https://srcincite.io/advisories/src-2022-0014 · Note
• https://t.me/cibsecurity/46380 · Telegram Post