CVE-2022-35870

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 8.1.15 (b2022030114)

Description This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within com.inductiveautomation.metro.impl, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM.

Recommendations For version 8.1.15 (b2022030114), consider disabling the deserialization of untrusted data within com.inductiveautomation.metro.impl as a temporary workaround until a patch is available. Restrict access to the affected module to minimize the risk of exploitation. Avoid using user-supplied data in the affected implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.