The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10), allowing an attacker to obtain sensitive information.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-12000
• https://www.us-cert.gov/ics/advisories/icsa-20-147-01