CVE-2022-35890: Critical severity inductive automation ignition vulnerability
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to these IDs via Randy.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35890?
CVE-2022-35890 is classified as a medium severity vulnerability due to session ID mishandling.
How do I fix CVE-2022-35890?
To fix CVE-2022-35890, upgrade to Inductive Automation Ignition version 7.9.20 or 8.1.17 or later.
What software is affected by CVE-2022-35890?
CVE-2022-35890 affects Inductive Automation Ignition versions prior to 7.9.20 and from 8.0.1 to 8.1.16.
What does CVE-2022-35890 allow an attacker to do?
CVE-2022-35890 allows an attacker to hijack sessions by predicting previously generated session IDs.
Is there a workaround for CVE-2022-35890?
There are no known workarounds for CVE-2022-35890; updating the software is the recommended solution.