A SCADA Permission That Shipped Blank
Ignition's Create Project Role setting was empty by default, so the gateway enforced exactly what it was told: no role required. Fixed in 8.1.54, and configurable in a few minutes on older builds.
CISA advisory ICSA-26-246-06 covers Inductive Automation's Ignition, one of the most widely deployed SCADA and HMI platforms on the plant floor. The issue, CVE-2026-77393, is CWE-276 — incorrect default permissions — scoring 8.8 on CVSS v3.1 and 8.7 on v4.0, affecting version 8.1.53 and earlier.
The description is unusually plain. The gateway's Create Project Role setting shipped blank, which permitted any authenticated user to create projects. There is no memory corruption here and no clever exploitation chain: the access control worked exactly as configured, and it was configured to require nothing.
That makes it a more useful teaching case than most advisories. Buffer overflows and race conditions are the vendor's problem and the customer's patch cycle. A blank default is a shared failure — the vendor for shipping an empty permission on a security-relevant control, and every deployment that accepted the default without asking what it meant. It also means the fix is available to anyone who cannot upgrade immediately: on older 8.1 builds, populate the Create Project Role setting to match your Designer Role and the gap closes in an afternoon, without a change window or firmware campaign.
The permanent fix is version 8.1.54 or later, and the entire 8.3 series restricts project creation to Designer sessions only. Credit goes to Christopher Lusk of North Echo Security Research and Elhussain Fathy, with Inductive Automation reporting to CISA. Affected sectors are Critical Manufacturing, Energy and Information Technology.
The general lesson is worth stating because it transfers directly. Shipped defaults in a SCADA gateway deserve the same review as firewall rules, and a default that is blank rather than restrictive is the most dangerous kind, because a blank field reads as "not configured" to a human and as "no restriction" to the software. It is worth going through the security settings of any gateway platform and looking specifically for controls that are empty rather than set — those are the ones where nobody made a decision, and nobody will notice until an advisory names them.
Source: CISA