CVE-2023-38124

· HIGHAnalyzed

← All CVEs

CVSS v3.1

8.8

EPSS

59.61%

Published

May 3, 2024

Modified

Mar 13, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the Ignition Gateway server. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20541.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-749

Affected Products (1)

inductiveautomation · ignition (up to 8.1.26)vulnerable

References (4)

https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-23-1015/

Third Party Advisory

https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-23-1015/

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs