CVE-2022-1704: Inductive Automation Ignition

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-05 · updated 2026-06-17
Weakness: CWE-611

Description

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML security flags, which may lead to a XXE attack while restoring the backup.

Affected products

Inductive Automation Ignition: from 7.9.0 before 7.9.21; from 8.1.0 before 8.1.8 — fixed in 7.9.21, 8.1.8

How to fix

Upgrade to a fixed version: Inductive Automation Ignition 7.9.21, 8.1.8. Check the vendor advisory for mitigations.

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01
https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-01

Get alerted when CVE-2022-1704 or the next vulnerability affects your stack