CVE-2023-50218: Inductive Automation Ignition ModuleInvoke deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 and very high EPSS (99th percentile) with SYSTEM-level RCE, though exploitation requires valid low-privileged credentials and no KEV listing.

What it is

Inductive Automation Ignition fails to properly validate user-supplied data in the ModuleInvoke class, allowing deserialization of untrusted data. A remote attacker with valid credentials can exploit this to run arbitrary code on the affected installation. The flaw is rated CVSS 8.8 (HIGH) and affects the Ignition product.

Impact

An authenticated attacker gains remote code execution in the context of SYSTEM, giving full control of the Ignition host. This can lead to data theft, lateral movement, and disruption of industrial control processes.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires low-privileged authentication (PR:L). The flaw is in the ModuleInvoke class, which processes attacker-supplied serialized data.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.55031 (99th percentile), indicating a high likelihood of exploitation activity. References are vendor and ZDI advisories only, with no public exploit tag.

What to do

• Apply the vendor patch from the Inductive Automation security advisory for the affected Ignition versions.
• Restrict network access to Ignition services to trusted hosts and segments.
• Enforce least privilege and review accounts with low-privileged access to Ignition.
• Monitor for and block unexpected serialized payloads reaching ModuleInvoke endpoints.
• Keep Ignition and its modules updated and audit for similar deserialization issues.

Detection

• Monitor Ignition logs for deserialization errors or unexpected ModuleInvoke activity.
• Alert on suspicious child processes spawned by the Ignition service account.
• Inspect network traffic to Ignition ports for serialized payloads from unusual sources.
• Correlate authentication events with subsequent process creation on Ignition hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.