Vulnerabilities > CVE-2022-36126 - Incorrect Authorization vulnerability in Inductiveautomation Ignition
Attack vector
NETWORK Attack complexity
LOW Privileges required
HIGH Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbitrary code by supplying a Python script.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://github.com/sourceincite/randy
- https://github.com/sourceincite/randy
- https://srcincite.io/advisories/src-2022-0014/
- https://srcincite.io/advisories/src-2022-0014/
- https://support.inductiveautomation.com/hc/en-us/articles/7625759776653
- https://support.inductiveautomation.com/hc/en-us/articles/7625759776653