The version of Inductive Automation Ignition running on the remote host is affected by multiple vulnerabilities :

  - A denial of service (DoS) vulnerability exists due to an     unprotected logging route when the Perspective Module is running.     An unauthenticated, remote attacker can exploit this, via a     series of specially crafted messages, to write endless log     statements into the database without space limits, which can     results in consuming the entire available hard-disk space.
    (CVE-2020-10641)

  - A deserialization vulnerability exists due to the lack of proper     validation of user-supplied data. An unauthenticated, remote     attacker can exploit this to execute arbitrary code in the     context of SYSTEM. (CVE-2020-10644, CVE-2020-12000)

  - An information disclosure vulnerability exists in the getDiffs     method of the com.inductiveautomation.ignition.gateway.servlets.     gateway.functions.ProjectDownload class due to the lack of proper     authentication required to query the server. An unauthenticated,     remote attacker can exploit this to disclose potentially     sensitive information. (CVE-2020-12004)

Inductive Automation Ignition 8.x < 8.0.10 Multiple Vulnerabilities

high Nessus Plugin ID 137356

Version 1.44

Version 1.41

Version 1.44 May 1, 2023, 9:07 PM Detection (Make and use compatibility wrapper for running commands on scanner localhost to handle deprecation of pread().)
Version 1.41 Mar 8, 2023, 1:05 AM Logic Changes