Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20499.
References
| Link | Resource |
|---|---|
| https://inductiveautomation.com/downloads/releasenotes/8.1.33 | Release Notes |
| https://inductiveautomation.com/downloads/releasenotes/8.1.33 | Release Notes |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1050/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1050/ | Third Party Advisory |
Configurations
History
12 Mar 2025, 14:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-23-1050/ - Third Party Advisory | |
| References | () https://inductiveautomation.com/downloads/releasenotes/8.1.33 - Release Notes | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Inductiveautomation ignition
Inductiveautomation |
|
| CPE | cpe:2.3:a:inductiveautomation:ignition:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
03 May 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-03 03:15
Updated : 2025-03-12 14:29
NVD link : CVE-2023-39477
Mitre link : CVE-2023-39477
JSON object : View
Products Affected
inductiveautomation
- ignition
CWE