CVE-2023-39479 is a High severity (NVD CVSS 8.8) flaw in Softing Secure Integration Server where the OPC UA gateway lets an authenticated user create directories through FileDirectory objects. ZDI lists no fixed version, so check Softing for an advisory and restrict who can reach the service.
What's affected
The record names Softing Secure Integration Server. NVD's product data does not give a clean list of affected builds. The ZDI advisory does not list affected versions and does not name a fixed release.
NVD scores this 8.8 (CVSS 3.1, network, low complexity, low privileges). ZDI scores it 6.6 (CVSS 3.0, high attack complexity, high privileges). Both are worth knowing: the lower ZDI score reflects a view that exploitation is harder and needs high privileges, while NVD scores it as network reachable with low complexity. Plan around the higher score until Softing says otherwise.
How to check if you're exposed
There is no scanner command that is reliable here. Start with an inventory:
- Find every Secure Integration Server install, including test and lab systems.
- Read the product version from the server's administration interface or installer record.
- Check which networks can reach the OPC UA and web ports, and who holds accounts.
- Ask Softing for its advisory and fixed version, since the ZDI page does not list one.
What to do now
- Inventory all Softing Secure Integration Server installs and note their versions.
- Contact Softing and check its security advisories for a fixed release for this CVE, since none is listed by ZDI.
- Restrict network access to the server to the systems and people who need it. ZDI's only listed mitigation is to restrict interaction with the application.
- Review accounts and remove any that are unused, because the flaw needs authentication even though the record says the authentication mechanism can be bypassed.
- Place the server behind segmentation so a compromise cannot reach wider plant or office networks.
Why it matters
The weakness class is CWE-552 (files or directories accessible to external parties). The record says the flaw sits in the handling of FileDirectory OPC UA Objects and results from allowing unauthorized access to the filesystem. It adds that the existing authentication mechanism can be bypassed, and that an attacker could combine this with other vulnerabilities to run code as root.
Industrial gateways often sit between IT and operational networks, which raises the cost of a flaw even when the base score is not the highest. The ZDI advisory shows the issue was reported on 2023-02-22 (the page also mentions 2023-02-16 from Pwn2Own Miami) and published as a coordinated zero-day advisory on 2023-08-09, with no fixed version recorded. NVD published the record on 2024-05-03. The KEV flag is false.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Quick check
Is there a patch?
The ZDI advisory lists no fixed version. Check Softing's own security advisories before assuming one exists or does not.
Why do the scores differ?
NVD uses CVSS 3.1 and scores it 8.8. ZDI uses CVSS 3.0 and scores it 6.6 because it rates complexity and privileges higher. The advisory text is the same.
Sources
Last reviewed: 19 October 2026.
