CVE-2023-38124: Inductive Automation Ignition Gateway exposed dangerous function RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and SYSTEM-level code execution, plus very high EPSS, though authentication is required and no KEV listing exists.

What it is

Inductive Automation Ignition Gateway exposes a dangerous function in its OPC UA Quick Client task scheduling component, allowing an authenticated remote attacker to execute arbitrary code. The flaw is a CWE-749 exposed dangerous function issue in the Ignition Gateway server. It matters because successful exploitation yields code execution as SYSTEM on an industrial automation platform.

Impact

An attacker gains arbitrary code execution in the context of SYSTEM on the Ignition Gateway server. This can lead to full compromise of the gateway and potentially connected industrial control systems.

Attack surface

Reachable over the network via the Ignition Gateway server (AV:N, AC:L). Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware usage documented. EPSS is 0.59609 (99th percentile), indicating a high predicted likelihood of exploitation, though no public exploit is confirmed in the record.

What to do

• Apply the vendor patch or upgrade to a fixed Ignition version as referenced in the vendor advisory.
• Restrict network access to the Ignition Gateway and OPC UA interfaces to trusted hosts only.
• Enforce least privilege for Ignition accounts and avoid granting unnecessary task scheduling permissions.
• Monitor and audit task scheduling configurations for unauthorized changes.
• Segment industrial networks to limit lateral movement from a compromised gateway.

Detection

• Monitor Ignition Gateway logs for unexpected task scheduling creation or modification events.
• Alert on processes spawning from the Ignition Gateway service, especially those running as SYSTEM.
• Detect anomalous network connections to the OPC UA Quick Client or task scheduling endpoints.
• Review authentication logs for unusual or off-hours access to Ignition administrative functions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.