Ignition vulnerabilities

25 known vulnerabilities in Ignition from Inductive Automation. 25 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

25vulnerabilities

5critical

20high

0exploited

8.7average CVSS score

Latest first

8.8 High severity
Ignition: Incorrect Authorization
CVE-2026-92817Oct 14, 2026Inductive Automation
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges.
8.8 High severity
Ignition: Incorrect Default Permissions
CVE-2026-77393Sep 4, 2026Inductive Automation
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no
8.8 High severity
Ignition: Improper Limitation of a Pathname to a Restricted Directory
CVE-2023-50233May 3, 2024Inductive AutomationEPSS 2.08%
Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is requir
8.8 High severity
Ignition: Improper Neutralization of Argument Delimiters in a Command
CVE-2023-50232May 3, 2024Inductive AutomationEPSS 1.39%
Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exp
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50223May 3, 2024Inductive AutomationEPSS 54.9%
Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authenti
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50222May 3, 2024Inductive AutomationEPSS 1.15%
Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Us
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50221May 3, 2024Inductive AutomationEPSS 1.15%
Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Igniti
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50220May 3, 2024Inductive AutomationEPSS 1.85%
Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication i
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50219May 3, 2024Inductive AutomationEPSS 1.5%
Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is req
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50218May 3, 2024Inductive AutomationEPSS 55%
Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is
7.5 High severity
Ignition: Uncontrolled Resource Consumption
CVE-2023-39477May 3, 2024Inductive AutomationEPSS 1.54%
Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Inductive Automation Ignition. Authentication is
9.8 Critical severity
Ignition: Deserialization of Untrusted Data
CVE-2023-39476May 3, 2024Inductive AutomationEPSS 2.23%
Inductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authent
9.8 Critical severity
Ignition: Deserialization of Untrusted Data
CVE-2023-39475May 3, 2024Inductive AutomationEPSS 64.1%
Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation I
8.8 High severity
Ignition: Download of Code Without Integrity Check
CVE-2023-39474May 3, 2024Inductive Automation
Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-39473May 3, 2024Inductive AutomationEPSS 62.5%
Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authen
8.8 High severity
Ignition: Exposed Dangerous Method or Function
CVE-2023-38124May 3, 2024Inductive AutomationEPSS 59.6%
Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. A
8.8 High severity
Ignition: Missing Authentication for Critical Functionality
CVE-2023-38123May 3, 2024Inductive AutomationEPSS 1.17%
Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition.
7.2 High severity
Ignition: Permissive Cross-domain Security Policy with Untrusted Domains
CVE-2023-38122May 3, 2024Inductive AutomationEPSS 1.88%
Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Although auth
9.0 Critical severity
Ignition: Improper Neutralization of Input During Web Page Generation
CVE-2023-38121May 3, 2024Inductive AutomationEPSS 1.24%
Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is req
9.8 Critical severity
Ignition: Improper Restriction of XML External Entity Reference
CVE-2022-1704Aug 5, 2022Inductive AutomationEPSS 1.03%
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.
7.8 High severity
Ignition: Missing User Interaction for Potentially Unsafe Action
CVE-2022-35873Jul 25, 2022Inductive Automation
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or o
7.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2022-35872Jul 25, 2022Inductive Automation
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or o
7.8 High severity
Ignition: Missing Authentication for Critical Functionality
CVE-2022-35871Jul 25, 2022Inductive AutomationEPSS 41%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within the authenticate
7.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2022-35870Jul 25, 2022Inductive AutomationEPSS 44.3%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although authentication is required to exploit this vulnerability, the existing authentication mechanism can b
9.8 Critical severity
Ignition: Authentication Bypass Using an Alternate Path or Channel
CVE-2022-35869Jul 25, 2022Inductive AutomationEPSS 59.9%
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within com.inductiveauto