CVE-2022-35869
Published: 25 July 2022
Summary
CVE-2022-35869 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Inductiveautomation Ignition. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 14.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
This vulnerability is an authentication bypass flaw in Inductive Automation Ignition version 8.1.15 (build b2022030114). It resides in the com.inductiveautomation.ignition.gateway.web.pages component and stems from missing authentication checks before granting access to functionality, as tracked under CWE-288. The issue carries a CVSS 3.1 score of 9.8 and was originally reported as ZDI-CAN-17211.
Remote attackers can exploit the flaw without any credentials or user interaction to bypass authentication entirely on affected installations. Successful exploitation grants attackers full control over the system, resulting in high impact to confidentiality, integrity, and availability.
Advisories from the Zero Day Initiative and Inductive Automation address the issue in the context of Pwn2Own 2022 findings, with mitigation details and updates referenced at the vendor support portal and ZDI-22-1016.
The EPSS score rose materially from a low baseline to a peak of 0.1434 on 2025-01-22 before receding to 0.0256, indicating that exploitation interest emerged well after the 2022 disclosure and that the CVE merits renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38742
Vulnerability details
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within com.inductiveautomation.ignition.gateway.web.pages. The issue results from the lack of proper authentication…
more
prior to access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17211.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.
Users can identify logons via alternate paths or channels by reviewing the previous logon time.
Adaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.
Centralized IdPs close alternate authentication paths that enable bypass.
Enforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.
Requires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.