The precondition carries the whole finding. An attacker needs an authenticated account plus the ability to execute gateway scripts [2]. On most gateways that is not the full user population, but it is a wider set than the Designer role holders an operator would assume were the only people able to stand up a project [6]. The exposure lives in the gap between those two groups.
Inductive Automation frames it as a default-value problem: the security control enforced exactly what the "Create Project Role(s)" setting specified, and because the setting shipped blank, no role was required [5]. CISA files it as CWE-276, incorrect default permissions [7]. It is a permissions-default flaw rather than a code-level one, the setting shipped open, and reachability depends entirely on who has script execution.
There are two remediation paths, and they carry different operational costs. Upgrading to 8.1.54 restricts project creation to Designer sessions and removes the setting from the decision [3]. Remaining on an earlier 8.1 build and populating the field to match your Designer Role also fully closes it, by the vendor's account, after which only holders of that role can create projects [6][5]. For a gateway behind a change window that is weeks out, the second path is a text field rather than a service restart.
The version arithmetic is unusually friendly. 8.1.53 to 8.1.54 is a single patch increment inside the same branch, and the 8.3 series was never affected, so nobody is being asked to migrate a major version to get the fix [13].
Determining whether you were ever exposed means reading a config value, not a version string. An operator who populated "Create Project Role(s)" when the gateway was commissioned held the same 8.1.53 build and had no exposure at all [5]. That is why fleet-level answers are slow here: the affected population is defined by which sites filled in a field, across critical manufacturing, energy and IT deployments worldwide [8].
Two researchers arrived at it independently. Christopher Lusk of North Echo Security Research reported it to the vendor, and Elhussain Fathy (0xSphinx) reported it separately and confirmed the fix [9][10][14]. CISA states there is no known public exploitation specifically targeting the flaw [11], and its advisory attaches the standard ICS mitigation block about keeping control systems off the internet and behind firewalls [12]. That guidance is sound in general and irrelevant to this bug, because the attacker in this model already has credentials.
Defaults that mean "allow" keep producing advisories of this shape. They do not surface in a dependency scan or a code review. They surface in a config export, which is the artefact fewest OT teams diff between releases.
