Which versions of Ignition SCADA are affected by CVE-2025-13911?

Inductive Automation Ignition contains a privilege escalation vulnerability that allows Gateway Administrators to gain complete operating system control of the host machine.

How to fix or mitigate CVE-2025-13911?

Within 24 hours: immediately restrict the Gateway Administrator role to absolutely essential personnel, disable or restrict access to the backup/restore feature where operationally feasible, and audit all current administrator accounts. Within 7 days: enable detailed logging and real-time alerting for all backup/restore operations and administrative actions, review access logs for unauthorized activity, and confirm inventory of all systems running Ignition in OT/ICS environments. Within 30 days: implement network segmentation to isolate Ignition systems from unnecessary network access, enforce multi-factor authentication for all Gateway Administrator accounts, deploy privileged access management (PAM) solutions to control and monitor administrative access, and establish direct contact with Inductive Automation to confirm patch availability timeline and request interim security guidance.

Ignition SCADA CVE-2025-13911

Q: What is the CVSS score of CVE-2025-13911?

CVE-2025-13911 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Execution with Unnecessary Privileges (CWE-250)

2025-12-18 ics-cert@hq.dhs.gov

Privilege Escalation RCE Microsoft

7.3

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.4 HIGH

Adjacent OT network required (AV:A); Gateway Administrator mandatory (PR:H); scope changes as execution escalates from Ignition app to OS SYSTEM or root.

3.1 AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 02:30 vuln.today

CVE Published

Dec 18, 2025 - 21:15 cve.org

HIGH 7.3

DescriptionCVE.org

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code execution risk via the gateway backup restore functionality. An authenticated user with Gateway Administrator privileges can import a malicious gateway backup (.gwbk) file containing crafted project resources, scripts, or modules, resulting in code execution on the host system. This affects both Windows and Linux installations. On Windows, default installations often run the Ignition service as NT AUTHORITY\SYSTEM, resulting in code execution with full local system privileges. On Linux, default installations commonly run the Ignition service as root or with elevated privileges. Specific privilege level depends on installation configuration.

AnalysisAI

Code execution on the underlying host OS through Ignition's gateway backup restore feature enables a Gateway Administrator to escalate from application-level access to full OS-level privileges. On default Windows installations the Ignition service runs as NT AUTHORITY\SYSTEM, and on Linux typically as root, meaning successful exploitation yields complete control of the host - a particularly severe outcome in ICS/OT environments where Ignition interfaces with plant floor systems. No public exploit code or CISA KEV listing has been identified at time of analysis; the adjacent network vector (AV:A) and mandatory Gateway Administrator access (PR:H) materially constrain opportunistic exploitation.

Technical ContextAI

Ignition is an industrial automation platform by Inductive Automation widely deployed as a SCADA/HMI gateway in manufacturing, utilities, and critical infrastructure. The gateway backup format (.gwbk) is a composite archive that can embed project resources, Jython/Python scripts, and custom Java modules, all of which execute within the Ignition service process context upon import. CWE-250 (Execution with Unnecessary Privileges) identifies the root cause: Ignition's OS service account is provisioned by default with excessive privileges - NT AUTHORITY\SYSTEM on Windows, root or elevated accounts on Linux - rather than a dedicated least-privilege service identity. The backup restore pathway accepts arbitrary executable content from Gateway Administrators without sandboxing or privilege separation between the application runtime and the host OS, allowing crafted backup content to reach the OS privilege boundary. The CISA ICS advisory ICSA-25-352-01 originated from ICS-CERT (ics-cert@hq.dhs.gov), confirming this as an OT-sector issue.

Affected ProductsAI

Ignition by Inductive Automation on both Windows and Linux is affected when installed using default OS service account settings. On Windows, the highest-impact configurations are those where the Ignition gateway service runs as NT AUTHORITY\SYSTEM, which is common in default installations. On Linux, installations where the service runs as root or with elevated OS privileges are similarly exposed. Specific version ranges and CPE strings were not enumerated in the available intelligence data; the authoritative source for affected version ranges is the Inductive Automation security advisory at https://security.inductiveautomation.com/ and CISA ICS advisory ICSA-25-352-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-352-01.

RemediationAI

The primary remediation, per the Inductive Automation security advisory (https://security.inductiveautomation.com/) and CISA ICS advisory ICSA-25-352-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-352-01), is to reconfigure the Ignition OS service to run under a dedicated least-privilege service account rather than NT AUTHORITY\SYSTEM or root. On Windows, create a domain or local service account with only the filesystem and network permissions Ignition requires, update the service logon via services.msc or Group Policy, and verify the service starts cleanly - note that restricting the account may require granting explicit read/write access to Ignition's installation directory and data paths. On Linux, create a dedicated non-root user (e.g., ignition), update the systemd unit file's User= directive, and adjust directory ownership accordingly; be aware that some integrations requiring raw socket or hardware access may need supplementary group memberships rather than root. As a compensating control, strictly audit and minimize who holds Gateway Administrator privileges within Ignition, since the attack is gated entirely on that credential. No specific patched software version was identified in the available data - consult the vendor advisory for any application-level mitigations or version updates beyond service account hardening.