Inductiveautomation
Inductiveautomation Ignition: vulnerabilidades y CVE
Inductiveautomation Ignition tiene 37 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 6 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE37
Últimos 12 meses3
Críticas6
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-77393 | Alta (8.7) | 0.51% | — | 4 sept 2026 | In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts… |
| CVE-2025-13913 | Media (5.4) | 0.34% | — | 12 mar 2026 | A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code. |
| CVE-2025-13911 | Alta (7.3) | 0.25% | — | 18 dic 2025 | Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code execution risk via the gateway backup restore functionality. An authenticated… |
| CVE-2023-50233 | Alta (8.8) | 2.1% | — | 3 may 2024 | Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive… |
| CVE-2023-50232 | Alta (8.8) | 1.4% | — | 3 may 2024 | Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation… |
| CVE-2023-50223 | Alta (8.8) | 55% | — | 3 may 2024 | Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations… |
| CVE-2023-50222 | Alta (8.8) | 1.1% | — | 3 may 2024 | Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
| CVE-2023-50221 | Alta (8.8) | 1.1% | — | 3 may 2024 | Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
| CVE-2023-50220 | Alta (8.8) | 1.8% | — | 3 may 2024 | Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of… |
| CVE-2023-50219 | Alta (8.8) | 1.5% | — | 3 may 2024 | Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive… |
| CVE-2023-50218 | Alta (8.8) | 55% | — | 3 may 2024 | Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of… |
| CVE-2023-39477 | Alta (7.5) | 1.5% | — | 3 may 2024 | Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of… |
| CVE-2023-39476 | Crítica (9.8) | 2.2% | — | 3 may 2024 | Inductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations… |
| CVE-2023-39475 | Crítica (9.8) | 64% | — | 3 may 2024 | Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
| CVE-2023-39474 | Alta (8.8) | 0.62% | — | 3 may 2024 | Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition.… |
| CVE-2023-39473 | Alta (8.8) | 62% | — | 3 may 2024 | Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations… |
| CVE-2023-39472 | Media (6.5) | 1.3% | — | 3 may 2024 | Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations… |
| CVE-2023-38124 | Alta (8.8) | 60% | — | 3 may 2024 | Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
| CVE-2023-38123 | Alta (8.8) | 1.2% | — | 3 may 2024 | Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected… |
| CVE-2023-38122 | Alta (7.2) | 1.9% | — | 3 may 2024 | Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of… |
| CVE-2023-38121 | Crítica (9) | 1.2% | — | 3 may 2024 | Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive… |
| CVE-2022-1704 | Crítica (9.8) | 1.0% | — | 5 ago 2022 | Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup. |
| CVE-2022-35873 | Alta (7.8) | 0.71% | — | 25 jul 2022 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that… |
| CVE-2022-35872 | Alta (7.8) | 0.70% | — | 25 jul 2022 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that… |
| CVE-2022-35871 | Alta (7.8) | 39% | — | 25 jul 2022 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The… |
| CVE-2022-35870 | Alta (7.8) | 43% | — | 25 jul 2022 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although authentication is required to exploit this vulnerability,… |
| CVE-2022-35869 | Crítica (9.8) | 60% | — | 25 jul 2022 | This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The… |
| CVE-2022-1264 | Alta (8.8) | 0.94% | — | 20 jul 2022 | The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code. |
| CVE-2022-36126 | Alta (7.2) | 2.6% | — | 16 jul 2022 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbitrary code by supplying a Python script. |
| CVE-2022-35890 | Crítica (9.8) | 2.0% | — | 15 jul 2022 | An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.