CVE-2023-38124 is a high severity flaw in Ignition Gateway where a dangerous task scheduling function is exposed to authenticated users, allowing code execution as SYSTEM according to ZDI. NVD scores it 8.8 and ZDI 7.2. Upgrade to 8.1.26 or later and confirm the fixed version with the vendor.
What's affected
The product is Inductive Automation Ignition. The flaw is in the Ignition Gateway server, which exposes a dangerous function through task scheduling. Authentication is required. ZDI says an attacker can use it to execute code in the context of SYSTEM. The record is dated 2024-05-03.
The scores differ. NVD gives 8.8, High, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. ZDI-23-1015 gives 7.2.
Inductive Automation's own blog post on Pwn2Own Miami 2023 says the security update for the remote code execution issue is included in Ignition 8.1.26, scheduled for stable release on 21 March 2023. It does not map each CVE to a specific version. The NVD record lists Ignition without a version range, and ZDI says only that the vendor has issued an update. Treat 8.1.26 as the minimum to look for, and confirm against Inductive Automation's security advisories for the exact fix of this CVE.
Weakness class: CWE-749.
How to check if you're exposed
Read the Gateway version and compare it with 8.1.26. Then review who holds accounts on the Gateway, because the flaw needs a login. List users with designer or administrator roles and check each is still needed.
Look in the Gateway logs for scheduled tasks or scripts you did not create.
What to do now
- Record Ignition versions across all Gateways.
- Upgrade to 8.1.26 or later and check the vendor advisory for the fixed version of this CVE.
- Remove unused accounts and reduce the number of users with elevated roles.
- Review scheduled tasks and gateway scripts for anything unexpected.
- Keep the Gateway off the Internet and behind a VPN or jump host.
Why it matters
The weakness is an exposed dangerous method. The product offers a function that can run work on the server, and an authenticated user can reach it even though it does not need to be reachable. The remedy is least privilege: only roles that truly need to schedule tasks should be able to.
A low-privilege login requirement lowers the bar less than it seems. Accounts are shared, passwords are reused, and other bugs in the same release, such as the authentication bypass in CVE-2023-38123, can hand over a login. Patch the set. The CVE is not on the CISA Known Exploited Vulnerabilities list.
An exposed dangerous method or function means the product offers a powerful operation, here a way to run scheduled work, to callers who should not be able to reach it. The defensive pattern is least privilege: expose only the operations a role needs, and keep operations that run code or commands behind the narrowest possible permission.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Why does a login requirement not make this safe?
Other flaws from the same disclosure can supply a login, and shared or reused credentials are common on industrial systems.
Where is the fix?
Inductive Automation points to 8.1.26. Confirm this CVE's fixed version in the vendor advisory.
Sources
Last reviewed: 19 October 2026.
