writeups.xyz / Pwn2Owning Two Hosts At The Same Time: Abusing Inductive Automation Ignition’s Custom Deserialization

Submitter : c2a

Date: 8 February 2023

Bounty : undisclosed

Vulnerabilities :

• Insecure Deserialization
• RCE
• Security Code Review

Programs :

• Inductive Automation Ignition

Authors :

• Piotr Bazydło (@Chudypb)

Link :
https://www.zerodayinitiative.com/blog/2023/2/6/pwn2owning-two-hosts-at-the-same-time-abusing-inductive-automation-ignitions-custom-deserialization