CVE-2022-35890

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-15 · updated 2026-06-17
Weakness: CWE-863

Description

An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to these IDs via Randy.

Affected products

Inductive Automation Ignition: before 7.9.20; from 8.0.1 before 8.1.17 — fixed in 7.9.20, 8.1.17

How to fix

Upgrade to a fixed version: Inductive Automation Ignition 7.9.20, 8.1.17. Check the vendor advisory for mitigations.

References

https://github.com/sourceincite/randy
https://support.inductiveautomation.com/hc/en-us/articles/7625759776653
https://github.com/sourceincite/randy
https://support.inductiveautomation.com/hc/en-us/articles/7625759776653

Get alerted when CVE-2022-35890 or the next vulnerability affects your stack