CVE-2023-39476 is a critical severity (CVSS 9.8) deserialization of untrusted data flaw in Inductive Automation Ignition, in the JavaSerializationCodec class. A remote attacker needs no login and could run code as SYSTEM. ZDI published it as a zero day advisory and we found no fixed version, so limit access to the Gateway.
What's affected
The NVD record names Inductive Automation Ignition, with no version range. It scores the flaw 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network, low complexity, no privileges, no interaction, and high impact on all three areas. ZDI scores it the same, 9.8.
The weakness class is CWE-502 (deserialization of untrusted data). ZDI-23-1046, published 8 August 2023, says the issue results from missing validation of user supplied data in the JavaSerializationCodec class. It is a sibling of CVE-2023-39475, which concerns a related class named ParameterVersionJavaSerializationCodec.
We found no fixed version for this CVE in the NVD record or in the ZDI advisory, and the Ignition 8.1.33 release notes name only CVE-2023-39477 among these Ignition CVEs. A fix may exist in a later release, so check Inductive Automation's security information and release notes for your version before relying on anything here.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Open the Ignition Gateway web interface and read the version it reports, and note the same on the Designer and any Vision or Perspective clients.
Then find out who can reach the Gateway. List the network paths to its web ports and to any OPC UA or other service it exposes, and who holds Gateway accounts. Because the ZDI advisory names restricting interaction with the application as the mitigation, the network path is the control you can check today.
What to do now
- Inventory every Ignition Gateway, including test and disaster recovery installs, with its version.
- Check Inductive Automation's security information and release notes for a fix that covers this CVE and update to it. The record and the ZDI advisory name none.
- Restrict network access to the Gateway to the hosts and people that need it, using firewalls and segmentation. This is the mitigation ZDI gives.
- Review which accounts exist on the Gateway and remove ones that are not needed.
- Do not expose the Gateway to the internet. If remote access is needed, use a VPN.
Why it matters
The class here handles Java serialized data, which is a format that can carry whole object graphs. When a service accepts that format from a network client without limiting the classes it will accept, crafted input can lead to code running in the service. ZDI says the data is not validated and that the code runs as SYSTEM.
Because two sibling CVEs describe the same pattern in two codec classes, a fix for one may not cover the other, so check that any vendor update names both. The control that works today is the same as for the sibling: keep the Gateway reachable only from places that need it, and remove it from the internet.
Quick check
How is this different from CVE-2023-39475?
It is the same kind of flaw in a different class. CVE-2023-39475 is in ParameterVersionJavaSerializationCodec, and this one is in JavaSerializationCodec.
Do I need an account?
No. The vector has no privileges and ZDI says authentication is not required.
Sources
- Zero Day Initiative advisory ZDI-23-1046
- Ignition 8.1.33 release notes
- Safeguard Gold entry for CVE-2023-39476
Last reviewed: 19 October 2026.
