CVE-2023-39473 is a high severity (CVSS 8.8) deserialization of untrusted data flaw in Inductive Automation Ignition, in the AbstractGatewayFunction class. An authenticated remote attacker could run code as SYSTEM. ZDI published it as a zero day advisory, and we found no fixed version, so restrict access to the Gateway.
What's affected
The NVD record names Inductive Automation Ignition, with no version range. It scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which is network, low complexity, low privileges and no user interaction. ZDI scores it the same, 8.8.
The weakness class is CWE-502 (deserialization of untrusted data). ZDI-23-1045, published 8 August 2023, says the issue results from missing validation of user supplied data in the AbstractGatewayFunction class. It was labelled a zero day advisory because the vendor had not yet shipped a patch: ZDI first reported it on 6 June 2022 and the vendor said it was still in development in July 2023.
We found no fixed version for this CVE in the NVD record or in the ZDI advisory, and the Ignition 8.1.33 release notes name only CVE-2023-39477 among these Ignition CVEs. A fix may exist in a later release, so check Inductive Automation's security information and release notes for your version before relying on anything here.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Open the Ignition Gateway web interface and read the version it reports, and note the same on the Designer and any Vision or Perspective clients.
Then find out who can reach the Gateway. List the network paths to its web ports and to any OPC UA or other service it exposes, and who holds Gateway accounts. Because the ZDI advisory names restricting interaction with the application as the mitigation, the network path is the control you can check today.
What to do now
- Inventory every Ignition Gateway, including test and disaster recovery installs, with its version.
- Check Inductive Automation's security information and release notes for a fix that covers this CVE and update to it. The record and the ZDI advisory name none.
- Restrict network access to the Gateway to the hosts and people that need it, using firewalls and segmentation. This is the mitigation ZDI gives.
- Review which accounts exist on the Gateway and remove ones that are not needed.
- Do not expose the Gateway to the internet. If remote access is needed, use a VPN.
Why it matters
Deserialization turns bytes from a request back into program objects. If the bytes are not validated first, a crafted input can make the program build objects that do things the developers never planned. ZDI says this is the case in the AbstractGatewayFunction class, and that code then runs as SYSTEM, the highest account on a Windows host.
Ignition often runs industrial control and monitoring, so a compromise of the Gateway can reach plant data and connected systems. A login is required, which narrows the exposure, but Gateways commonly have many accounts for operators and integrators. The ZDI mitigation is blunt: restrict interaction with the application. Treat network segmentation and account hygiene as the working controls until you can confirm a fix.
Try it yourself
This one was published before the vendor had a fix. This demo shows how zero day watch tracks issues in that window.
Click through it at your own pace, or open it full screen.
Quick check
Do I need an account to exploit this?
The vector asks for low privileges and ZDI says authentication is required. An attacker needs a Gateway login first.
Is there a patch?
We could not confirm one. Check Inductive Automation's release notes and security information for your version.
Sources
- Zero Day Initiative advisory ZDI-23-1045
- Ignition 8.1.33 release notes
- Safeguard Gold entry for CVE-2023-39473
Last reviewed: 19 October 2026.
