CVE-2022-36126

moderate-risk
Published 2022-07-16

An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbitrary code by supplying a Python script.

Do I need to act?

~
3.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Inductiveautomation

References (6)

Exploit https://github.com/sourceincite/randy
Third Party Advisory https://srcincite.io/advisories/src-2022-0014/
Vendor Advisory https://support.inductiveautomation.com/hc/en-us/articles/7625759776653
Exploit https://github.com/sourceincite/randy
Third Party Advisory https://srcincite.io/advisories/src-2022-0014/
Vendor Advisory https://support.inductiveautomation.com/hc/en-us/articles/7625759776653
38
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 7/34 · Low
Exposure 5/34 · Minimal