CVE-2023-38123 is a high severity authentication bypass in Inductive Automation Ignition: password change functionality can be reached without authentication. NVD scores it 8.8 and ZDI scores it 7.5. Upgrade to Ignition 8.1.26 or later and confirm the exact fixed version in the vendor advisory.
What's affected
The product is Inductive Automation Ignition. ZDI describes a missing authentication check before access to password change functionality in the server configuration. The target must visit a malicious page or open a malicious file, so user interaction is required. The record is dated 2024-05-03.
The scores differ. NVD gives 8.8, High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. ZDI-23-1014 gives 7.5. Both are High, and both are worth acting on.
Inductive Automation's own blog post on Pwn2Own Miami 2023 says the security update for the remote code execution issue is included in Ignition 8.1.26, scheduled for stable release on 21 March 2023. It does not map each CVE to a specific version. The NVD record lists Ignition without a version range, and ZDI says only that the vendor has issued an update. Treat 8.1.26 as the minimum to look for, and confirm against Inductive Automation's security advisories for the exact fix of this CVE.
Weakness class: CWE-306.
How to check if you're exposed
Read the Ignition version on each Gateway and compare it with 8.1.26. Then review account activity for unexpected password changes, which would be the visible sign of abuse of this kind of weakness.
Check the Gateway audit log for password change events on user accounts you do not expect, and confirm who is allowed to reach the web interface at all.
What to do now
- Inventory Ignition Gateways and record versions.
- Upgrade to 8.1.26 or later, and check the vendor advisory for this CVE's fixed version.
- Review the audit log for password changes you cannot explain.
- Rotate administrator passwords after the upgrade and enable stronger authentication where your setup allows it.
- Restrict browser access to the Gateway to trusted networks.
Why it matters
A function that changes credentials is among the most sensitive in any application. When it can be reached without proving identity, the rest of the access model rests on nothing. The weakness class is missing authentication for a critical function, and the fix is to check identity on the server for every request that changes a password.
This case also needs a victim to visit a page or open a file, so awareness helps, but the real control is the patch. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisories I read do not report exploitation in the wild.
Missing authentication for a critical function means a sensitive action, such as changing a password, can be reached without proving who is asking. Every function that changes credentials, configuration or access should check identity and permission on the server side, whatever the user interface shows or hides.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Which score should I use?
Use the higher of the two for planning, 8.8 from NVD, and read the ZDI advisory for its reasoning behind 7.5.
What should I look for after patching?
Check the audit log for unexpected password changes and rotate privileged credentials.
Sources
Last reviewed: 19 October 2026.
