CVE-2023-50221 is a high severity (CVSS 8.8) deserialization flaw in the ResponseParser method of Inductive Automation Ignition. It affects clients that connect to a malicious server, and code runs in the context of the current user. Inductive Automation has issued an update. We could not confirm the exact fixed version from the sources we read, so check the vendor security page and upgrade.
What's affected
- Inductive Automation Ignition, per the NVD record, which lists the product without version bounds.
- Fixed by a vendor update. The Zero Day Initiative advisory says Inductive Automation has issued an update and points to the vendor security page. The page we read did not give a version number for this issue, so confirm the fixed release there.
- User interaction is required: the target must connect to a malicious server. Code runs as the current user, not SYSTEM.
- Attack conditions: Network, low complexity, no privileges, user interaction required.
- Disclosure: reported to the vendor in 2023 and publicly released through the Zero Day Initiative as ZDI-24-016 (tracked as ZDI-CAN-21926) on 5 January 2024.
- Related issues: the same batch of reports includes CVE-2023-50218, CVE-2023-50219, CVE-2023-50220, all deserialization flaws in different Ignition components. Upgrading once covers the set if the vendor release addresses all of them, which you should confirm with the vendor.
- KEV status: the record shows kev as false.
How to check if you're exposed
Find your Ignition version on the Gateway web page or in the Designer about dialog. Compare it with the fixed release named in the vendor security information. Then list who can sign in to the Gateway and Designer and from where, since several of these flaws need an authenticated user.
The Gateway status page in the web interface shows the installed version. We did not find a documented command line check, so use the web page or ask your Ignition administrator.
What to do now
- Record the version of every Ignition Gateway and Designer client in use.
- Upgrade to the current Ignition release from Inductive Automation, and check the vendor security page for the fixed version of CVE-2023-50221.
- Restrict network access to the Gateway. It should not be reachable from the internet, and access from corporate networks should be limited to those who need it.
- Review accounts and roles on the Gateway, remove unused ones, and enforce strong credentials.
- For client side issues, only connect Designer and Vision clients to Gateways you trust.
Why it matters
This is CWE-502, deserialization of untrusted data. When software rebuilds objects from bytes it receives, an attacker who controls those bytes may be able to make the application create objects that run code. The Zero Day Initiative description says the flaw comes from a lack of proper validation of user supplied data before it is deserialized in the ResponseParser component.
Ignition is used in industrial control and operations systems, where a compromise of the Gateway can reach plant data and connected equipment. Running as SYSTEM, as the record states for the server side cases, gives an attacker full control of the host. Network segmentation and a short list of authorized users reduce the risk even before patching is complete.
Quick check
Do I need valid credentials to exploit this?
No account is needed, but the target must connect to a malicious server, so user interaction is required.
What version fixes it?
The Zero Day Initiative advisory says the vendor issued an update but does not name a version. Check the Inductive Automation security page for the exact release.
Sources
- NVD record for CVE-2023-50221
- Zero Day Initiative advisory ZDI-24-016
- Inductive Automation security page
Last reviewed: 19 October 2026.
