Vulnerability record · CVE-2023-39475 · published 3 May 2024
CVE-2023-39475: Inductive Automation Ignition Java deserialization RCE
Inductiveautomation · Ignition
Inductive Automation Ignition fails to validate user-supplied data in the ParameterVersionJavaSerializationCodec class, allowing deserialization of untrusted data. A remote, unauthenticated attacker can exploit this to run arbitrary code, making it a severe risk for exposed Ignition installations.
Description
Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ParameterVersionJavaSerializationCodec class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20290.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required and a very high EPSS score make this a top-priority remote code execution flaw.
What it is
Inductive Automation Ignition fails to validate user-supplied data in the ParameterVersionJavaSerializationCodec class, allowing deserialization of untrusted data. A remote, unauthenticated attacker can exploit this to run arbitrary code, making it a severe risk for exposed Ignition installations.
Impact
An attacker gains remote code execution in the context of SYSTEM, leading to full compromise of the affected host and any data or services it can reach.
Attack surface
Reachable over the network via the affected codec endpoint; the CVSS vector shows no privileges or user interaction required, so any network-reachable instance is exposed.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high at 0.64 (99th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the vendor patch for the affected Ignition version as soon as it is available
- Restrict network access to Ignition services to trusted hosts and segments
- Disable or block the ParameterVersionJavaSerializationCodec path if it is not required
- Run Ignition with least privilege rather than SYSTEM where feasible
- Monitor vendor advisories and ZDI-23-1047 for updated guidance
Detection
- Alert on unexpected Java deserialization traffic or serialized object payloads to Ignition endpoints
- Monitor for child processes spawned by the Ignition service, especially command shells or scripting interpreters
- Watch for anomalous outbound connections from Ignition hosts that could indicate post-exploitation activity
- Review Ignition logs for errors or unusual requests touching the ParameterVersionJavaSerializationCodec class
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1047/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1047/ | Third Party Advisory |
Track CVE-2023-39475 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-39475), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
