CVE-2023-39481 is a High severity (NVD CVSS 8.8) remote code execution flaw in the web server of Softing Secure Integration Server, caused by a URI parsing mismatch between NGINX and application code. ZDI lists no fixed version, so check Softing for an advisory and limit access to the service.
What's affected
The record names Softing Secure Integration Server. NVD's product data does not give a clean list of affected builds. The ZDI advisory does not list affected versions and does not name a fixed release.
NVD scores this 8.8 (CVSS 3.1). The ZDI advisory scores it 6.6 (CVSS 3.0, high attack complexity, high privileges). Both are worth knowing: the lower ZDI score reflects a view that exploitation is harder and needs high privileges, while NVD scores it as network reachable with low complexity. Plan around the higher score until Softing says otherwise.
How to check if you're exposed
There is no scanner command that is reliable here. Start with an inventory:
- Find every Secure Integration Server install, including test and lab systems.
- Read the product version from the server's administration interface or installer record.
- Check which networks can reach the OPC UA and web ports, and who holds accounts.
- Ask Softing for its advisory and fixed version, since the ZDI page does not list one.
What to do now
- Inventory all Softing Secure Integration Server installs and note their versions.
- Contact Softing and check its security advisories for a fixed release for this CVE, since none is listed by ZDI.
- Restrict network access to the server to the systems and people who need it. ZDI's only listed mitigation is to restrict interaction with the application.
- Review accounts and remove any that are unused, because the flaw needs authentication even though the record says the authentication mechanism can be bypassed.
- Place the server behind segmentation so a compromise cannot reach wider plant or office networks.
Why it matters
The weakness class is CWE-436 (interpretation conflict). The record says the issue results from an inconsistency in URI parsing between NGINX and the application code. It adds that authentication is required but can be bypassed, and that an attacker could chain this with other flaws to execute code as root.
Industrial gateways often sit between IT and operational networks, which raises the cost of a flaw even when the base score is not the highest. The ZDI advisory shows the issue was reported on 2023-02-22 (the page also mentions 2023-02-16 from Pwn2Own Miami) and published as a coordinated zero-day advisory on 2023-08-09, with no fixed version recorded. NVD published the record on 2024-05-03. The KEV flag is false.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
The ZDI advisory lists no fixed version. Check Softing's own security advisories before assuming one exists or does not.
Why do the scores differ?
NVD uses CVSS 3.1 and scores it 8.8. ZDI uses CVSS 3.0 and scores it 6.6 because it rates complexity and privileges higher. The advisory text is the same.
Sources
Last reviewed: 19 October 2026.
