CVE-2023-39477 is a high severity (CVSS 7.5) resource exhaustion flaw in Inductive Automation Ignition. A remote attacker with no login could send many OPC UA ConditionRefresh requests and use up the server's resources. Inductive Automation fixed it in Ignition 8.1.33.
What's affected
The NVD record names Inductive Automation Ignition, with no version range. It scores the flaw 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which is network, no privileges, and high impact on availability only. ZDI scores it the same, 7.5.
The fix is confirmed in the vendor's Ignition 8.1.33 release notes for 8.1.33, which lists ZDI-CAN-20499 (CVE-2023-39477) as fixed, a possible resource exhaustion vulnerability, and notes an update of the Milo OPC UA SDK to version 0.6.11 in the same release. The ZDI advisory credits Claroty Team82 and was published 8 August 2023, then updated on 19 December 2023 to point at the vendor fix.
The weakness class is CWE-400 (uncontrolled resource consumption). The release notes do not say which earlier versions are affected, so treat anything older than 8.1.33 on the 8.1 line as exposed and read the notes for other branches. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Open the Ignition Gateway web interface and read the version it reports, and note the same on the Designer and any Vision or Perspective clients.
Then find out who can reach the Gateway. List the network paths to its web ports and to any OPC UA or other service it exposes, and who holds Gateway accounts. Because the ZDI advisory names restricting interaction with the application as the mitigation, the network path is the control you can check today.
What to do now
- Inventory every Ignition Gateway with its version.
- Update to Ignition 8.1.33 or later, using the release notes for upgrade guidance, and test the Gateway after the update.
- Restrict network access to the OPC UA service to the clients that need it.
- Watch Gateway resource use for sudden spikes, since this flaw works by exhausting resources.
- If you run another branch, check Inductive Automation's notes for the fix on that branch.
Why it matters
OPC UA is a common industrial protocol, and ConditionRefresh is a request that asks a server to resend its current alarm and condition state. A server that handles a large number of such requests without limits can run out of memory or processing time. ZDI says that by sending many requests an attacker can consume all available resources.
The impact is availability only. In a plant that can still be serious, because monitoring and alarming go dark exactly when they are needed. There is a vendor fix, so this is one of the easier entries in the group to resolve. Update, and keep the OPC UA port off untrusted networks.
Quick check
Is a fix available?
Yes. The Ignition 8.1.33 release notes say the issue was fixed in that release.
Can this steal data or run code?
No. The record rates only availability impact, with none on confidentiality or integrity.
Sources
- Zero Day Initiative advisory ZDI-23-1050
- Ignition 8.1.33 release notes
- Safeguard Gold entry for CVE-2023-39477
Last reviewed: 19 October 2026.
