CVE-2022-35870: (Pwn2Own) Inductive Automation Ignition Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within com.inductiveautomation.metro.impl. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17265.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within com.inductiveautomation.metro.impl. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-35870 vulnerability?
(Pwn2Own) Inductive Automation Ignition Deserialization of Untrusted Data Remote Code Execution Vulnerability.
How severe is CVE-2022-35870?
CVE-2022-35870 has a severity keyword of 'high' with a CVSS score of 8.8.
What software versions are affected by CVE-2022-35870?
Inductive Automation Ignition 8.1.15 (b2022030114) is affected by CVE-2022-35870.
Is authentication required to exploit CVE-2022-35870?
Authentication is required to exploit CVE-2022-35870, but the existing mechanism can be bypassed.
How can I fix CVE-2022-35870 vulnerability?
To address CVE-2022-35870, it is recommended to apply the patches provided by the vendor and follow their security advisory.