Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Inductive Automation Ignition Execution with Unnecessary Privileges
Vulnerability Description
The vulnerability affects Ignition SCADA applications where Python scripting is utilized for automation purposes. The vulnerability arises from the absence of proper security controls that restrict which Python libraries can be imported and executed within the scripting environment. The core issue lies in the Ignition service account having system permissions beyond what an Ignition privileged user requires. When an authenticated administrator uploads a malicious project file containing Python scripts with bind shell capabilities, the application executes these scripts with the same privileges as the Ignition Gateway process, which typically runs with SYSTEM-level permissions on Windows. Alternative code execution patterns could lead to similar results.
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
带着不必要的权限执行
Vulnerability Title
Inductive Automation Ignition 安全漏洞
Vulnerability Description
Inductive Automation Ignition是美国Inductive Automation公司的一套用于SCADA系统的集成软件平台。该平台支持SCADA（数据采集与监控系统）、HMI（人机界面）等。 Inductive Automation Ignition存在安全漏洞，该漏洞源于缺少安全控制，可能导致系统权限提升。
CVSS Information
N/A
Vulnerability Type
N/A