Sign-up

ID

VAR-202308-2284


CVE

CVE-2023-38123


TITLE

Inductive Automation  of  Ignition  Vulnerability regarding lack of authentication for critical features in

Trust: 0.8

sources: JVNDB: JVNDB-2023-028401

DESCRIPTION

Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the server configuration. The issue results from the lack of authentication prior to allowing access to password change functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20540. (DoS) It may be in a state. Inductive Automation Ignition‌ is a comprehensive platform for industrial automation that provides scalable solutions for monitoring, control, data collection and analysis. Ignition was developed by Inductive Automation to help users build and deploy automation systems that meet specific needs‌

Trust: 2.79

sources: NVD: CVE-2023-38123 // JVNDB: JVNDB-2023-028401 // ZDI: ZDI-23-1014 // CNVD: CNVD-2024-48764

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-48764

AFFECTED PRODUCTS

vendor:inductive automationmodel:ignitionscope: - version: -

Trust: 1.5

vendor:inductiveautomationmodel:ignitionscope:ltversion:8.1.26

Trust: 1.0

vendor:inductive automationmodel:ignitionscope:eqversion: -

Trust: 0.8

vendor:inductive automationmodel:ignitionscope:eqversion:8.1.26

Trust: 0.8

vendor:inductivemodel:automation ignitionscope:eqversion:8.1.24

Trust: 0.6

sources: ZDI: ZDI-23-1014 // CNVD: CNVD-2024-48764 // JVNDB: JVNDB-2023-028401 // NVD: CVE-2023-38123

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2023-38123
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-38123
value: HIGH

Trust: 1.0

NVD: CVE-2023-38123
value: HIGH

Trust: 0.8

ZDI: CVE-2023-38123
value: HIGH

Trust: 0.7

CNVD: CNVD-2024-48764
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-48764
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2023-38123
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.9
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2023-38123
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-38123
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-38123
baseSeverity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.6
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-1014 // CNVD: CNVD-2024-48764 // JVNDB: JVNDB-2023-028401 // NVD: CVE-2023-38123 // NVD: CVE-2023-38123

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.0

problemtype:Lack of authentication for critical features (CWE-306) [ others ]

Trust: 0.8

problemtype: Lack of authentication for critical features (CWE-306) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-028401 // NVD: CVE-2023-38123

PATCH

title:Inductive Automation has issued an update to correct this vulnerability.url:https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Trust: 0.7

title:Patch for Inductive Automation Ignition Authentication Bypass Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/644276

Trust: 0.6

sources: ZDI: ZDI-23-1014 // CNVD: CNVD-2024-48764

EXTERNAL IDS

db:NVDid:CVE-2023-38123

Trust: 3.9

db:ZDIid:ZDI-23-1014

Trust: 3.1

db:JVNDBid:JVNDB-2023-028401

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-20540

Trust: 0.7

db:CNVDid:CNVD-2024-48764

Trust: 0.6

sources: ZDI: ZDI-23-1014 // CNVD: CNVD-2024-48764 // JVNDB: JVNDB-2023-028401 // NVD: CVE-2023-38123

REFERENCES

url:https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security

Trust: 2.5

url:https://www.zerodayinitiative.com/advisories/zdi-23-1014/

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2023-38123

Trust: 0.8

sources: ZDI: ZDI-23-1014 // CNVD: CNVD-2024-48764 // JVNDB: JVNDB-2023-028401 // NVD: CVE-2023-38123

CREDITS

20urdjk

Trust: 0.7

sources: ZDI: ZDI-23-1014

SOURCES

db:ZDIid:ZDI-23-1014
db:CNVDid:CNVD-2024-48764
db:JVNDBid:JVNDB-2023-028401
db:NVDid:CVE-2023-38123

LAST UPDATE DATE

2025-03-18T23:20:42.853000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-1014date:2023-08-01T00:00:00
db:CNVDid:CNVD-2024-48764date:2024-12-20T00:00:00
db:JVNDBid:JVNDB-2023-028401date:2025-03-17T07:40:00
db:NVDid:CVE-2023-38123date:2025-03-13T21:44:04.253

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-1014date:2023-08-01T00:00:00
db:CNVDid:CNVD-2024-48764date:2023-08-03T00:00:00
db:JVNDBid:JVNDB-2023-028401date:2025-03-17T00:00:00
db:NVDid:CVE-2023-38123date:2024-05-03T02:15:56.740