CVE-2023-39474 is a high severity (CVSS 8.8) flaw in Inductive Automation Ignition. The downloadLaunchClientJar function loads a remote JAR file without validating it, so a user who connects to a malicious server can have code run as themselves. The sources disagree on the score, and we found no fixed version.
What's affected
The NVD record names Inductive Automation Ignition, with no version range. It scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which is network, low complexity, no privileges and user interaction required.
ZDI-23-1049 scores it 8.0 with the vector AV:A/AC:L/PR:N/UI:R, so adjacent network and not network. Both are High, and we report both. The weakness class is CWE-494 (download of code without integrity check).
ZDI-23-1049, published 8 August 2023 as a zero day advisory, says the target must connect to a malicious server, and the code runs in the context of the current user.
We found no fixed version for this CVE in the NVD record or in the ZDI advisory, and the Ignition 8.1.33 release notes name only CVE-2023-39477 among these Ignition CVEs. A fix may exist in a later release, so check Inductive Automation's security information and release notes for your version before relying on anything here.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Open the Ignition Gateway web interface and read the version it reports, and note the same on the Designer and any Vision or Perspective clients.
Then find out who can reach the Gateway. List the network paths to its web ports and to any OPC UA or other service it exposes, and who holds Gateway accounts. Because the ZDI advisory names restricting interaction with the application as the mitigation, the network path is the control you can check today.
What to do now
- Inventory every Ignition Gateway, including test and disaster recovery installs, with its version.
- Check Inductive Automation's security information and release notes for a fix that covers this CVE and update to it. The record and the ZDI advisory name none.
- Restrict network access to the Gateway to the hosts and people that need it, using firewalls and segmentation. This is the mitigation ZDI gives.
- Review which accounts exist on the Gateway and remove ones that are not needed.
- Do not expose the Gateway to the internet. If remote access is needed, use a VPN.
Why it matters
This flaw works in the opposite direction from most server bugs. The client side function downloadLaunchClientJar fetches a JAR file from a server and loads it without checking it. A user who is tricked into connecting to a server the attacker controls ends up running the attacker's code, as that user.
Operators and engineers connect to Gateways all day, and a network position that lets an attacker impersonate a Gateway is enough to try. The practical controls are to connect only to Gateways you know, and to protect the network paths between clients and servers. The ZDI advice is to restrict interaction with the application.
Quick check
Does this need a user to do something?
Yes. The target must connect to a malicious server, so user interaction is required.
Why do NVD and ZDI scores differ?
NVD uses a network vector and gives 8.8. ZDI uses an adjacent network vector and gives 8.0. Both are High.
Sources
- Zero Day Initiative advisory ZDI-23-1049
- Ignition 8.1.33 release notes
- Safeguard Gold entry for CVE-2023-39474
Last reviewed: 19 October 2026.
