CVE-2023-39478 is an exposure of resource to the wrong sphere flaw in Softing Secure Integration Server 1.22.0.8686. NVD scores it 8.8 High, while ZDI scores it 6.6 Medium. An attacker who bypasses authentication could chain it with other bugs to run code as root. We found no fixed version.
What's affected
The NVD record names Softing Secure Integration Server 1.22.0.8686. It scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which is network, low complexity and low privileges.
The sources disagree. ZDI-23-1060 scores the same flaw 6.6, with the vector AV:N/AC:H/PR:H/UI:N, so high complexity and high privileges, which is Medium. We report both and suggest you read the advisory.
The weakness class is CWE-668 (exposure of resource to wrong sphere). ZDI-23-1060, published 9 August 2023, says the flaw is in the handling of OPC FileDirectory namespaces, where user supplied data is not validated before a server object is created. It says that although authentication is required, the existing mechanism can be bypassed, and that an attacker can use this together with other vulnerabilities to run code as root. ZDI reported it during the Pwn2Own Miami contest in February 2023.
We found no fixed version in the record or in the ZDI advisory, and we did not find a vendor page. Check Softing's security information for a release newer than 1.22.0.8686. The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Find out whether Softing Secure Integration Server runs in your environment, which often means industrial gateways and OPC UA aggregation points. Check the installed version in the product's administration interface or your installation records. The record names 1.22.0.8686.
Then check who can reach it. The ZDI mitigation is to restrict interaction with the application, so the network path and the accounts on the server are what you can control.
What to do now
- Inventory every Softing Secure Integration Server and its version.
- Check Softing's security notices for a fixed release and apply it. The record and ZDI name none.
- Restrict network access to the server to the hosts that need it, and keep it off the internet.
- Review accounts on the server and remove any that are not needed.
- Monitor the server for unexpected file or namespace changes.
Why it matters
The record says the issue is in how OPC FileDirectory namespaces are handled. A namespace is a part of the address space that an OPC UA server shows to clients. If user supplied data is used to create a server object without validation, a client can influence what the server builds, and that is a step toward running code.
The advisory says this is one link in a chain. It needs other vulnerabilities, including one that bypasses authentication, to reach code execution as root. That is part of why the two scores differ so much. For a defender the lesson is the chain. Several bugs found together at Pwn2Own can add up, so fix the others in the same product too, and limit who can reach the server.
Quick check
Why do the two scores differ?
NVD rates it 8.8 with low complexity and low privileges. ZDI rates it 6.6 with high complexity and high privileges. We cannot tell which is better for your setup, so read the advisory.
Can this be exploited alone?
ZDI says an attacker can use it in conjunction with other vulnerabilities to run code, so it is part of a chain.
Sources
Last reviewed: 19 October 2026.
