CVE-2020-14479 : Exploit Details and Defense Strategies

CVE-2020-14479, also known as ICSA-20-147-01 Inductive Automation Ignition (Update B), involves vulnerabilities in Ignition 7 Gateway and Ignition 8 Gateway by Inductive Automation.

Understanding CVE-2020-14479

This CVE was published on July 14, 2020, and is related to the mishandling of serialized data leading to unauthorized access due to inadequate authentication.

What is CVE-2020-14479?

The vulnerability allows attackers to retrieve sensitive information by exploiting the lack of proper authentication protocols when querying the server.

The Impact of CVE-2020-14479

The CVSS base score of 5.3 indicates a medium severity vulnerability with low confidentiality impact and no integrity impact. The attack complexity is low, and it requires no privileges or user interaction.

Technical Details of CVE-2020-14479

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The issue arises from the mishandling of serialized data, which lacks the necessary authentication controls, enabling unauthorized access to sensitive information.

Affected Systems and Versions

Ignition 7 Gateway versions prior to 7.9.14 are affected.
Ignition 8 Gateway versions prior to 8.0.10 are affected.

Exploitation Mechanism

Attackers can exploit this vulnerability over a network without requiring any user interaction, making it a potential risk for systems with exposed services.

Mitigation and Prevention

It is crucial to take immediate steps to mitigate the risks posed by CVE-2020-14479.

Immediate Steps to Take

Limit interactions with the service to trusted machines only.
Allow communication with the service only between clients and servers with a legitimate procedural relationship.
Implement firewall rules or allow-listing to control access.

Long-Term Security Practices

Regularly update and patch the affected systems.
Conduct security assessments and audits to identify and address vulnerabilities proactively.

Patching and Updates

Inductive Automation plans to address this vulnerability in future product versions. Refer to the specified version in Inductive Automation's release notes for more information on software updates and patches.