The Vulnerable Perspective module does not validate session privileges properly. An authenticated user with Vision project access can supply a valid Vision session identifier to gain Designer‑level privileges. This privilege escalation allows execution of arbitrary code under the Ignition Gateway process, compromising confidentiality, integrity, and availability of the system. The weakness is reflected in CWE‑266 (Inadequate Privilege Management) and CWE‑863 (Privilege Escalation via Session Manipulation).

Inductive Automation Ignition is affected. Versions before the releases that address the issue (8.3.9 and 8.1.55) remain vulnerable. All earlier releases not yet patched are at risk. The scope spans the entire Ignition Gateway environment and the applications that rely on it.

The CVSS score of 8.7 indicates high severity. Though the EPSS score is below 1%, indicating a low probability of exploitation, the vulnerability remains exploitable. It is not listed in CISA’s KEV catalog. Attackers must be authenticated users with Vision project access; the likely attack vector therefore originates from within a trusted network or by an insider. Once a Vision session identifier is captured or spoofed, the attacker can elevate privileges and execute arbitrary code. No additional authorization checks are performed by the module, making the exploit straightforward for an attacker in possession of such credentials.