Sign-up

ID

VAR-202207-1127


CVE

CVE-2022-35870


TITLE

Inductive Automation  of  Ignition  Untrusted Data Deserialization Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-013800

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within com.inductiveautomation.metro.impl. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17265. (DoS) It may be in a state. Inductive Automation Ignition‌ is a comprehensive platform for industrial automation that provides scalable solutions for monitoring, control, data collection and analysis. No detailed vulnerability details are available at this time

Trust: 2.88

sources: NVD: CVE-2022-35870 // JVNDB: JVNDB-2022-013800 // ZDI: ZDI-22-1017 // CNVD: CNVD-2025-02588 // VULMON: CVE-2022-35870

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-02588

AFFECTED PRODUCTS

vendor:inductive automationmodel:ignitionscope: - version: -

Trust: 1.5

vendor:inductiveautomationmodel:ignitionscope:eqversion:8.1.15

Trust: 1.0

vendor:inductive automationmodel:ignitionscope:eqversion: -

Trust: 0.8

vendor:inductive automationmodel:ignitionscope:eqversion:8.1.15

Trust: 0.8

vendor:inductivemodel:automation inductive automation ignitionscope:gteversion:7.9.0,<=8.1.16

Trust: 0.6

sources: ZDI: ZDI-22-1017 // CNVD: CNVD-2025-02588 // JVNDB: JVNDB-2022-013800 // NVD: CVE-2022-35870

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-35870
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-35870
value: HIGH

Trust: 1.0

NVD: CVE-2022-35870
value: HIGH

Trust: 0.8

ZDI: CVE-2022-35870
value: HIGH

Trust: 0.7

CNVD: CNVD-2025-02588
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202207-1483
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-02588
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-35870
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2022-35870
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-35870
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-35870
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1017 // CNVD: CNVD-2025-02588 // JVNDB: JVNDB-2022-013800 // CNNVD: CNNVD-202207-1483 // NVD: CVE-2022-35870 // NVD: CVE-2022-35870

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.0

problemtype:Deserialization of untrusted data (CWE-502) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-013800 // NVD: CVE-2022-35870

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202207-1483

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202207-1483

PATCH

title:Inductive Automation has issued an update to correct this vulnerability.url:https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities

Trust: 0.7

sources: ZDI: ZDI-22-1017

EXTERNAL IDS

db:NVDid:CVE-2022-35870

Trust: 4.6

db:ZDIid:ZDI-22-1017

Trust: 3.2

db:JVNDBid:JVNDB-2022-013800

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-17265

Trust: 0.7

db:CNVDid:CNVD-2025-02588

Trust: 0.6

db:CS-HELPid:SB2022071816

Trust: 0.6

db:CNNVDid:CNNVD-202207-1483

Trust: 0.6

db:VULMONid:CVE-2022-35870

Trust: 0.1

sources: ZDI: ZDI-22-1017 // CNVD: CNVD-2025-02588 // VULMON: CVE-2022-35870 // JVNDB: JVNDB-2022-013800 // CNNVD: CNNVD-202207-1483 // NVD: CVE-2022-35870

REFERENCES

url:https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-regarding-pwn2own-2022-vulnerabilities

Trust: 3.2

url:https://www.zerodayinitiative.com/advisories/zdi-22-1017/

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-35870

Trust: 0.8

url:https://support.inductiveautomation.com/hc/en-us

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-35870/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022071816

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-22-1017 // CNVD: CNVD-2025-02588 // VULMON: CVE-2022-35870 // JVNDB: JVNDB-2022-013800 // CNNVD: CNNVD-202207-1483 // NVD: CVE-2022-35870

CREDITS

@_s_n_t of @pentestltd

Trust: 0.7

sources: ZDI: ZDI-22-1017

SOURCES

db:ZDIid:ZDI-22-1017
db:CNVDid:CNVD-2025-02588
db:VULMONid:CVE-2022-35870
db:JVNDBid:JVNDB-2022-013800
db:CNNVDid:CNNVD-202207-1483
db:NVDid:CVE-2022-35870

LAST UPDATE DATE

2025-02-08T22:57:13.375000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1017date:2022-07-15T00:00:00
db:CNVDid:CNVD-2025-02588date:2025-02-07T00:00:00
db:VULMONid:CVE-2022-35870date:2022-07-26T00:00:00
db:JVNDBid:JVNDB-2022-013800date:2023-09-12T08:18:00
db:CNNVDid:CNNVD-202207-1483date:2022-08-04T00:00:00
db:NVDid:CVE-2022-35870date:2022-08-03T16:53:38.657

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1017date:2022-07-15T00:00:00
db:CNVDid:CNVD-2025-02588date:2025-02-07T00:00:00
db:VULMONid:CVE-2022-35870date:2022-07-25T00:00:00
db:JVNDBid:JVNDB-2022-013800date:2023-09-12T00:00:00
db:CNNVDid:CNNVD-202207-1483date:2022-07-18T00:00:00
db:NVDid:CVE-2022-35870date:2022-07-25T19:15:44.653