Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Ignition 7 Gateway by Inductive Automation
CVE-2020-14479 (GCVE-0-2020-14479)
Vulnerability from nvd – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:32
VLAI
Title
ICSA-20-147-01 Inductive Automation Ignition (Update B)
Summary
Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Inductive Automation | Ignition 7 Gateway |
Affected:
All , < 7.9.14
(custom)
|
|
| Inductive Automation | Ignition 8 Gateway |
Affected:
All , < 8.0.10
(custom)
|
Date Public
2020-07-14 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:46:34.702Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-14479",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:57:58.083822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:32:19.854Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Ignition 7 Gateway",
"vendor": "Inductive Automation",
"versions": [
{
"lessThan": "7.9.14",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"product": "Ignition 8 Gateway",
"vendor": "Inductive Automation",
"versions": [
{
"lessThan": "8.0.10",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Pedro Ribeiro, Radek Domanski, Chris Anastasio (muffin), and Steven Seeley (mr_me) working with Trend Micro\u2019s Zero Day Initiative reported these vulnerabilities to CISA."
}
],
"datePublic": "2020-07-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:52.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01"
}
],
"source": {
"advisory": "ICSA-20-147-01",
"discovery": "EXTERNAL"
},
"title": "ICSA-20-147-01 Inductive Automation Ignition (Update B)",
"workarounds": [
{
"lang": "en",
"value": "Please note CVE-2020-14479 does not have a fix in place. Induction Automation plans to correct this vulnerability in future product versions.\nIt is recommended to restrict interaction with the service to trusted machines. Only clients and servers with a legitimate procedural relationship should be permitted to communicate with the service. This can be done in various ways, most notably with firewall rules/allow listing.\nFor more information regarding software and patches, please refer to the specified version in Inductive Automation\u2019s release notes."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-07-14T17:00:00.000Z",
"ID": "CVE-2020-14479",
"STATE": "PUBLIC",
"TITLE": "ICSA-20-147-01 Inductive Automation Ignition (Update B)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Ignition 7 Gateway",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "7.9.14"
}
]
}
},
{
"product_name": "Ignition 8 Gateway",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "8.0.10"
}
]
}
}
]
},
"vendor_name": "Inductive Automation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Pedro Ribeiro, Radek Domanski, Chris Anastasio (muffin), and Steven Seeley (mr_me) working with Trend Micro\u2019s Zero Day Initiative reported these vulnerabilities to CISA."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-306 Missing Authentication for Critical Function"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01"
}
]
},
"source": {
"advisory": "ICSA-20-147-01",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Please note CVE-2020-14479 does not have a fix in place. Induction Automation plans to correct this vulnerability in future product versions.\nIt is recommended to restrict interaction with the service to trusted machines. Only clients and servers with a legitimate procedural relationship should be permitted to communicate with the service. This can be done in various ways, most notably with firewall rules/allow listing.\nFor more information regarding software and patches, please refer to the specified version in Inductive Automation\u2019s release notes."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-14479",
"datePublished": "2022-04-01T22:17:52.198Z",
"dateReserved": "2020-06-19T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:32:19.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14479 (GCVE-0-2020-14479)
Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2025-04-16 16:32
VLAI
Title
ICSA-20-147-01 Inductive Automation Ignition (Update B)
Summary
Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-2… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Inductive Automation | Ignition 7 Gateway |
Affected:
All , < 7.9.14
(custom)
|
|
| Inductive Automation | Ignition 8 Gateway |
Affected:
All , < 8.0.10
(custom)
|
Date Public
2020-07-14 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:46:34.702Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-14479",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:57:58.083822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:32:19.854Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Ignition 7 Gateway",
"vendor": "Inductive Automation",
"versions": [
{
"lessThan": "7.9.14",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"product": "Ignition 8 Gateway",
"vendor": "Inductive Automation",
"versions": [
{
"lessThan": "8.0.10",
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Pedro Ribeiro, Radek Domanski, Chris Anastasio (muffin), and Steven Seeley (mr_me) working with Trend Micro\u2019s Zero Day Initiative reported these vulnerabilities to CISA."
}
],
"datePublic": "2020-07-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-01T22:17:52.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01"
}
],
"source": {
"advisory": "ICSA-20-147-01",
"discovery": "EXTERNAL"
},
"title": "ICSA-20-147-01 Inductive Automation Ignition (Update B)",
"workarounds": [
{
"lang": "en",
"value": "Please note CVE-2020-14479 does not have a fix in place. Induction Automation plans to correct this vulnerability in future product versions.\nIt is recommended to restrict interaction with the service to trusted machines. Only clients and servers with a legitimate procedural relationship should be permitted to communicate with the service. This can be done in various ways, most notably with firewall rules/allow listing.\nFor more information regarding software and patches, please refer to the specified version in Inductive Automation\u2019s release notes."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-07-14T17:00:00.000Z",
"ID": "CVE-2020-14479",
"STATE": "PUBLIC",
"TITLE": "ICSA-20-147-01 Inductive Automation Ignition (Update B)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Ignition 7 Gateway",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "7.9.14"
}
]
}
},
{
"product_name": "Ignition 8 Gateway",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "All",
"version_value": "8.0.10"
}
]
}
}
]
},
"vendor_name": "Inductive Automation"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Pedro Ribeiro, Radek Domanski, Chris Anastasio (muffin), and Steven Seeley (mr_me) working with Trend Micro\u2019s Zero Day Initiative reported these vulnerabilities to CISA."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-306 Missing Authentication for Critical Function"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-20-147-01"
}
]
},
"source": {
"advisory": "ICSA-20-147-01",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "Please note CVE-2020-14479 does not have a fix in place. Induction Automation plans to correct this vulnerability in future product versions.\nIt is recommended to restrict interaction with the service to trusted machines. Only clients and servers with a legitimate procedural relationship should be permitted to communicate with the service. This can be done in various ways, most notably with firewall rules/allow listing.\nFor more information regarding software and patches, please refer to the specified version in Inductive Automation\u2019s release notes."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-14479",
"datePublished": "2022-04-01T22:17:52.198Z",
"dateReserved": "2020-06-19T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:32:19.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}