CoreCVE
Back

HIGH

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114)

Published Jul 25, 2022

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within the authenticateAdSso method. The issue results from the lack of authentication prior to allowing the execution of python code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17206.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner zdi
Published Jul 25, 2022
Updated Aug 3, 2024
Reserved Jul 14, 2022
Link CVE-2022-35871
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2022-35871
Red Hat
Severity n/a
Public date n/a
Links CVE-2022-35871