CVE-2023-39473: Inductive Automation Ignition deserialization flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with SYSTEM-level code execution and a very high EPSS score, though exploitation requires valid credentials and no KEV listing exists.

What it is

Inductive Automation Ignition fails to properly validate user-supplied data in the AbstractGatewayFunction class, allowing deserialization of untrusted data. A remote attacker with valid credentials can exploit this to run arbitrary code as SYSTEM on affected installations.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of SYSTEM, effectively full control of the Ignition gateway host.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires authentication (PR:L), so the attacker needs at least a low-privileged account on the target.

Exploitation

Not listed in CISA KEV and no public exploit references are provided beyond the ZDI advisory, though EPSS is high at roughly 0.62 (99th percentile), indicating elevated predicted exploitation activity.

What to do

• Apply the vendor patch for the affected Ignition release as soon as it is available from Inductive Automation.
• Restrict network access to the Ignition gateway so only trusted hosts and management networks can reach it.
• Enforce least privilege and review accounts with gateway access, removing or disabling unused credentials.
• Monitor and alert on unusual child processes or command execution spawned by the Ignition service account.

Detection

• Monitor Ignition gateway logs for deserialization errors or unexpected exceptions in AbstractGatewayFunction handling.
• Alert on suspicious process creation originating from the Ignition service, especially SYSTEM-level shells or scripting interpreters.
• Baseline and review outbound network connections from the Ignition host for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.