Sign-up

ID

VAR-202308-0868


CVE

CVE-2023-38124


TITLE

Inductive Automation  of  Ignition  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-028396

DESCRIPTION

Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the Ignition Gateway server. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20541. Inductive Automation of Ignition Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Inductive Automation Ignition‌ is a comprehensive platform for industrial automation that provides scalable solutions for monitoring, control, data collection and analysis

Trust: 2.88

sources: NVD: CVE-2023-38124 // JVNDB: JVNDB-2023-028396 // ZDI: ZDI-23-1015 // CNVD: CNVD-2024-48765 // VULMON: CVE-2023-38124

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-48765

AFFECTED PRODUCTS

vendor:inductive automationmodel:ignitionscope: - version: -

Trust: 1.5

vendor:inductiveautomationmodel:ignitionscope:ltversion:8.1.26

Trust: 1.0

vendor:inductive automationmodel:ignitionscope:eqversion: -

Trust: 0.8

vendor:inductive automationmodel:ignitionscope:eqversion:8.1.26

Trust: 0.8

vendor:inductivemodel:automation ignitionscope:eqversion:8.1.24

Trust: 0.6

sources: ZDI: ZDI-23-1015 // CNVD: CNVD-2024-48765 // JVNDB: JVNDB-2023-028396 // NVD: CVE-2023-38124

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2023-38124
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-38124
value: HIGH

Trust: 1.0

NVD: CVE-2023-38124
value: HIGH

Trust: 0.8

ZDI: CVE-2023-38124
value: HIGH

Trust: 0.7

CNVD: CNVD-2024-48765
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-48765
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2023-38124
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2023-38124
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-38124
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-38124
baseSeverity: HIGH
baseScore: 7.2
vectorString: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1015 // CNVD: CNVD-2024-48765 // JVNDB: JVNDB-2023-028396 // NVD: CVE-2023-38124 // NVD: CVE-2023-38124

PROBLEMTYPE DATA

problemtype:CWE-749

Trust: 1.0

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:Exposing dangerous methods or functions (CWE-749) [ others ]

Trust: 0.8

problemtype: others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-028396 // NVD: CVE-2023-38124

PATCH

title:Inductive Automation has issued an update to correct this vulnerability.url:https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Trust: 0.7

title:Patch for Inductive Automation Ignition OPC UA Quick Client Task Scheduling Remote Code Execution Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/644281

Trust: 0.6

sources: ZDI: ZDI-23-1015 // CNVD: CNVD-2024-48765

EXTERNAL IDS

db:NVDid:CVE-2023-38124

Trust: 4.0

db:ZDIid:ZDI-23-1015

Trust: 3.2

db:JVNDBid:JVNDB-2023-028396

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-20541

Trust: 0.7

db:CNVDid:CNVD-2024-48765

Trust: 0.6

db:VULMONid:CVE-2023-38124

Trust: 0.1

sources: ZDI: ZDI-23-1015 // CNVD: CNVD-2024-48765 // VULMON: CVE-2023-38124 // JVNDB: JVNDB-2023-028396 // NVD: CVE-2023-38124

REFERENCES

url:https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Trust: 2.5

url:https://www.zerodayinitiative.com/advisories/zdi-23-1015/

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2023-38124

Trust: 0.8

sources: ZDI: ZDI-23-1015 // CNVD: CNVD-2024-48765 // VULMON: CVE-2023-38124 // JVNDB: JVNDB-2023-028396 // NVD: CVE-2023-38124

CREDITS

20urdjk

Trust: 0.7

sources: ZDI: ZDI-23-1015

SOURCES

db:ZDIid:ZDI-23-1015
db:CNVDid:CNVD-2024-48765
db:VULMONid:CVE-2023-38124
db:JVNDBid:JVNDB-2023-028396
db:NVDid:CVE-2023-38124

LAST UPDATE DATE

2025-03-19T23:00:09.285000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1015date:2023-08-01T00:00:00
db:CNVDid:CNVD-2024-48765date:2024-12-20T00:00:00
db:JVNDBid:JVNDB-2023-028396date:2025-03-17T02:51:00
db:NVDid:CVE-2023-38124date:2025-03-13T21:45:10.853

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1015date:2023-08-01T00:00:00
db:CNVDid:CNVD-2024-48765date:2023-08-03T00:00:00
db:JVNDBid:JVNDB-2023-028396date:2025-03-17T00:00:00
db:NVDid:CVE-2023-38124date:2024-05-03T03:15:10.060