Inductive Automation Ignition 8.1.x/8.3.x on Windows unnecessary privileges

Summaryinfo

A vulnerability was found in Inductive Automation Ignition 8.1.x/8.3.x on Windows. It has been rated as critical. This affects an unknown function. This manipulation causes unnecessary privileges. This vulnerability is tracked as CVE-2025-13911. The attack is only possible within the local network. No exploit exists.

Detailsinfo

A vulnerability has been found in Inductive Automation Ignition 8.1.x/8.3.x on Windows and classified as critical. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. The CWE definition for the vulnerability is CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The vulnerability affects Ignition SCADA applications where Python scripting is utilized for automation purposes. The vulnerability arises from the absence of proper security controls that restrict which Python libraries can be imported and executed within the scripting environment. The core issue lies in the Ignition service account having system permissions beyond what an Ignition privileged user requires. When an authenticated administrator uploads a malicious project file containing Python scripts with bind shell capabilities, the application executes these scripts with the same privileges as the Ignition Gateway process, which typically runs with SYSTEM-level permissions on Windows. Alternative code execution patterns could lead to similar results.

The weakness was disclosed by Momen Eldawakhly. The advisory is shared at security.inductiveautomation.com. This vulnerability is known as CVE-2025-13911 since 12/02/2025. The exploitation appears to be difficult. The attack needs to approached within the local network. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/18/2025). MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Automation Software

Vendor

• Inductive Automation

Name

• Ignition

Version

• 8.1.x
• 8.3.x

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion