Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

43 records

Vendor: Inductive Automation Clear all filters
TI-2026-53988 CVE-2026-77393 · GHSA-c95r-xfc2-mhwg

Inductive Automation Ignition Incorrect Default Permissions

Priority MEDIUM 40

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts).

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00506 Published 2026-09-04 Fixed in 8.1.54 CWE-276
TI-2025-12715 CVE-2025-13913 · GHSA-439v-7mv7-5p44

Inductive Automation Ignition Software Deserialization of Untrusted Data

Priority LOW 27

A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code.

CVSS 4.0MEDIUM 5.4 Adjacent network High privileges User interaction EPSS 0.00383 Published 2026-03-12 Fixed in 8.3.0 CWE-502
TI-2025-12713 CVE-2025-13911 · GHSA-wmxh-4mgr-2w85

Inductive Automation Ignition Execution with Unnecessary Privileges

Priority LOW 34

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code execution risk via the gateway backup restore functionality.

CVSS 4.0HIGH 7.3 Adjacent network High privileges No interaction EPSS 0.00253 Published 2025-12-18 No fix listed CWE-250
TI-2023-27465 CVE-2023-50233 · GHSA-pxh7-6hfh-c7c3

Path traversal in Inductive Automation Ignition

Priority MEDIUM 44

Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02081 Published 2024-05-03 No fix listed CWE-22
TI-2023-20607 CVE-2023-39475 · GHSA-5w76-2v5j-77r4

Deserialization of untrusted data in Inductive Automation Ignition

Priority HIGH 84

Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64076 Published 2024-05-03 No fix listed CWE-502
TI-2023-19547 CVE-2023-38123 · GHSA-qmh2-7rwj-4vp8

Missing authentication in Inductive Automation Ignition

Priority MEDIUM 42

Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01166 Published 2024-05-03 No fix listed CWE-306
TI-2023-19545 CVE-2023-38121 · GHSA-f526-9q5m-qh6g

Cross-site scripting in Inductive Automation Ignition

Priority MEDIUM 43

Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.01239 Published 2024-05-03 No fix listed CWE-79
TI-2022-01570 CVE-2022-1704 · GHSA-wj9q-g585-77cq

XML external entity injection in Inductive Automation Ignition

Priority MEDIUM 44

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01034 Published 2022-08-05 Fixed in 7.9.21 CWE-611
TI-2022-16303 CVE-2022-35872 · GHSA-7rph-7pwg-4mpv

Deserialization of untrusted data in Inductive Automation Ignition

Priority LOW 35

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114).

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00696 Published 2022-07-25 No fix listed CWE-502
Load more