attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Inductive Automation Ignition
Classified as
CWE-863 (Incorrect Authorization)
Exploitation prediction (EPSS)
0.48% probability of exploitation in the next 30 days (40% percentile) -- FIRST.org's EPSS model.
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Inductive Automation
Ignition
Subsystems
General OT
Sectors
Multiple
What to Know
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process. (NVD)
What to Do
Monitor Inductive Automation's web page for any future patch releases.