CVE-2023-39475 is a critical severity (CVSS 9.8) deserialization of untrusted data flaw in Inductive Automation Ignition, in the ParameterVersionJavaSerializationCodec class. A remote attacker needs no login and could run code as SYSTEM. ZDI published it as a zero day advisory and we found no fixed version, so limit access to the Gateway.
What's affected
The NVD record names Inductive Automation Ignition, with no version range. It scores the flaw 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network, low complexity, no privileges, no interaction, and high impact on all three areas. ZDI scores it the same, 9.8.
The weakness class is CWE-502 (deserialization of untrusted data). ZDI-23-1047, published 8 August 2023, says the issue results from missing validation of user supplied data in the ParameterVersionJavaSerializationCodec class. ZDI reported it on 10 March 2023, and in August the vendor said the case was under development but could not give a timeline.
We found no fixed version for this CVE in the NVD record or in the ZDI advisory, and the Ignition 8.1.33 release notes name only CVE-2023-39477 among these Ignition CVEs. A fix may exist in a later release, so check Inductive Automation's security information and release notes for your version before relying on anything here.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Open the Ignition Gateway web interface and read the version it reports, and note the same on the Designer and any Vision or Perspective clients.
Then find out who can reach the Gateway. List the network paths to its web ports and to any OPC UA or other service it exposes, and who holds Gateway accounts. Because the ZDI advisory names restricting interaction with the application as the mitigation, the network path is the control you can check today.
What to do now
- Inventory every Ignition Gateway, including test and disaster recovery installs, with its version.
- Check Inductive Automation's security information and release notes for a fix that covers this CVE and update to it. The record and the ZDI advisory name none.
- Restrict network access to the Gateway to the hosts and people that need it, using firewalls and segmentation. This is the mitigation ZDI gives.
- Review which accounts exist on the Gateway and remove ones that are not needed.
- Do not expose the Gateway to the internet. If remote access is needed, use a VPN.
Why it matters
Java deserialization bugs have a long history. A service reads bytes from the network and rebuilds objects from them. If the service does not restrict which classes it will build, crafted input can make it run code. ZDI says that in this codec class the data is not validated and the result is code execution as SYSTEM.
What makes this entry the one to act on first is the lack of authentication. Anything that can reach the affected service can attempt it. Industrial systems that were designed on isolated networks are sometimes later connected for remote monitoring, and a Gateway reachable from a business network or the internet is exposed. Take it off those paths, and review firewall rules.
Try it yourself
A critical score is a start, not an answer. This demo shows how an exploitability check helps you decide what needs attention first.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. The vector has no privileges and ZDI says authentication is not required.
Is this exploited in the wild?
Nothing we could read says so, and the record does not flag it as a CISA KEV entry. That can change, so keep watching.
Sources
- Zero Day Initiative advisory ZDI-23-1047
- Ignition 8.1.33 release notes
- Safeguard Gold entry for CVE-2023-39475
Last reviewed: 19 October 2026.
