CVE-2023-50223: Inductive Automation Ignition deserialization flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and SYSTEM-level code execution, plus a very high EPSS score, make this a serious risk despite the authentication requirement.

What it is

CVE-2023-50223 is a deserialization of untrusted data vulnerability in the ExtendedDocumentCodec class of Inductive Automation Ignition. The class fails to validate user-supplied data before deserializing it, letting an authenticated remote attacker run code as SYSTEM. Because Ignition is commonly deployed in industrial environments, successful exploitation can give an attacker full control of the host.

Impact

An attacker gains arbitrary code execution in the context of SYSTEM on the affected Ignition installation, effectively full control of the server.

Attack surface

The flaw is reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires low-privileged authentication (PR:L). Any authenticated account able to reach the vulnerable codec path can attempt exploitation.

Exploitation

The record shows no CISA KEV listing and no public exploit reference tags, but EPSS is 0.55177 (99th percentile), indicating a high modeled likelihood of exploitation activity. No ransomware group usage is documented.

What to do

• Apply the vendor patch or fixed release referenced in the Inductive Automation advisory (security.inductiveautomation.com).
• If patching is delayed, restrict network access to Ignition services to trusted hosts and segments.
• Enforce least privilege and review which accounts can reach the vulnerable codec functionality.
• Monitor for and block deserialization of untrusted data at application boundaries where feasible.
• Review the ZDI-24-018 advisory for additional vendor guidance.

Detection

• Monitor Ignition server logs and process behavior for unexpected child processes or command execution spawned by the Ignition service.
• Alert on anomalous network traffic to Ignition endpoints from authenticated sessions, especially serialized payload patterns.
• Baseline normal ExtendedDocumentCodec usage and flag unusual deserialization activity or payload sizes.
• Watch for SYSTEM-level process creation events originating from the Ignition service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.