PT-2022-23213

CVE-2022-36126

Published

2022-07-16

Updated

2022-07-23

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition versions 7.9.20 and earlier Inductive Automation Ignition versions 8.1.17 and earlier

Description An issue was discovered in Inductive Automation Ignition that allows remote attackers to execute arbitrary code by supplying a Python script using the ScriptInvoke function.

Recommendations For Inductive Automation Ignition versions 7.9.20 and earlier, update to version 7.9.20 or later. For Inductive Automation Ignition versions 8.1.17 and earlier, update to version 8.1.17 or later. As a temporary workaround, consider disabling the ScriptInvoke function until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration