PT-2024-13881 · Inductive Automation · Inductive Automation Ignition

Chudypb + 1 · Published 2024-02-21 · Updated 2025-03-12 · CVE-2023-50233

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition (affected versions not specified)

Description This issue allows remote attackers to execute arbitrary code on affected installations. It requires user interaction, where the target must connect to a malicious server. The flaw exists within the getJavaExecutable method due to the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this to execute code in the context of the current user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-50233

ZDI-24-185

Affected Products

Inductive Automation Ignition

References · 5

• https://security.inductiveautomation.com/?tcuUid=fc4c4515-046d-4365-b688-693337449c5b · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-185 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50233 · Security Note
• https://t.me/cvenotify/114445 · Telegram Post