CVE-2023-38121 is a critical severity (NVD 9.0) cross-site scripting flaw in the Ignition OPC UA Quick Client web interface that ZDI says can lead to code execution as SYSTEM. Inductive Automation has shipped a fix. Update Ignition to 8.1.26 or later and confirm the exact version in the vendor advisory.
What's affected
The product is Inductive Automation Ignition. The flaw is in the handling of the id parameter in the Ignition web interface, where untrusted input is not validated and can lead to script injection. The target must visit a malicious page or open a malicious file, so user interaction is required. The record is dated 2024-05-03.
The sources disagree on severity. NVD scores it 9.0, Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The ZDI advisory ZDI-23-1012 scores the same issue 8.3, which is High, with a higher attack complexity. Either way it deserves prompt patching.
Inductive Automation's own blog post on Pwn2Own Miami 2023 says the security update for the remote code execution issue is included in Ignition 8.1.26, scheduled for stable release on 21 March 2023. It does not map each CVE to a specific version. The NVD record lists Ignition without a version range, and ZDI says only that the vendor has issued an update. Treat 8.1.26 as the minimum to look for, and confirm against Inductive Automation's security advisories for the exact fix of this CVE.
Weakness class: CWE-79.
How to check if you're exposed
Open the Ignition Gateway web page and read the version shown in the footer or on the status overview. You can also read it from the Gateway status page under Config and then System. Anything below 8.1.26 should be treated as exposed until you confirm otherwise with the vendor.
Then check who can reach the Gateway web interface. List the networks and VPN groups with access to its ports, and note whether operators browse the Internet from the same workstation they use for Ignition.
What to do now
- Record the Ignition version on every Gateway and in every environment, including test systems.
- Upgrade to 8.1.26 or later following Inductive Automation's upgrade guidance, and check the vendor security advisories for this CVE.
- Restrict Gateway web access to the management network and named users.
- Tell operators not to open links or files from untrusted sources in the browser they use for Ignition.
- Review Content Security Policy and cross-origin settings on the Gateway after the upgrade.
Why it matters
Cross-site scripting normally steals a session or changes a page. Here the advisory describes a path to code execution as SYSTEM, which is why the scope metric in the vector is Changed: what the script reaches goes beyond the component that was injected. A single operator session with high privilege on an industrial gateway is a valuable thing to hijack.
Industrial software is often updated slowly because plants avoid downtime. That is the argument for compensating controls such as network segmentation, but it is not an argument for staying on an old version. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the sources I read do not claim exploitation.
Cross-site scripting happens when a web application places untrusted input into a page without encoding it for the context, so a browser treats the input as script. The usual defences are context-aware output encoding, strict input handling and a Content Security Policy that limits where script can come from. In an industrial web interface, script running in an administrator's browser session can reach functions the operator never meant to expose.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Why do NVD and ZDI show different scores?
They calculate the vector differently. NVD gives 9.0 and ZDI gives 8.3. Plan the patch on the higher figure and read both pages for the reasoning.
Does this need a logged-in user?
The NVD vector says low privileges are required, and ZDI says the target must visit a malicious page or open a malicious file.
Sources
Last reviewed: 19 October 2026.
