Inductive Automation Ignition 8.1.x/8.3.x on Windows unnecessary privileges

Summaryinfo

A vulnerability was found in Inductive Automation Ignition 8.1.x/8.3.x on Windows. It has been rated as critical. This affects an unknown function. This manipulation causes unnecessary privileges. This vulnerability is tracked as CVE-2025-13911. The attack is only possible within the local network. No exploit exists.

Detailsinfo

A vulnerability has been found in Inductive Automation Ignition 8.1.x/8.3.x on Windows and classified as critical. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. The CWE definition for the vulnerability is CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code execution risk via the gateway backup restore functionality. An authenticated user with Gateway Administrator privileges can import a malicious gateway backup (.gwbk) file containing crafted project resources, scripts, or modules, resulting in code execution on the host system. This affects both Windows and Linux installations. On Windows, default installations often run the Ignition service as NT AUTHORITY\SYSTEM, resulting in code execution with full local system privileges. On Linux, default installations commonly run the Ignition service as root or with elevated privileges. Specific privilege level depends on installation configuration.

The weakness was disclosed by Momen Eldawakhly. The advisory is shared at security.inductiveautomation.com. This vulnerability is known as CVE-2025-13911 since 12/02/2025. The exploitation appears to be difficult. The attack needs to approached within the local network. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/28/2026). MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Automation Software

Vendor

• Inductive Automation

Name

• Ignition

Version

• 8.1.x
• 8.3.x

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion