CVE-2023-50222 is a High severity (CVSS 8.8) deserialization of untrusted data flaw in Inductive Automation Ignition. It sits in the ResponseParser method and can lead to code execution as the current user. Inductive Automation has issued an update, so upgrade to the fixed release named in its security advisory.
What's affected
Product: Inductive Automation Ignition. The record lists the product with no version range, so it does not tell you which builds are affected. ZDI published the advisory as ZDI-24-017 on 5 January 2024, and NVD published the record on 3 May 2024.
I could not confirm a fixed version number from the pages I fetched. The ZDI advisory says Inductive Automation has issued an update, and points to the vendor security page, which loaded as a general trust center without a per-CVE version table. Treat the vendor advisory as the source of truth for the exact fixed release.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The user interaction part matters. Per ZDI, the target has to connect to a malicious server, which makes this a client side risk to the people running Ignition tools more than a direct hit on an exposed gateway.
How to check if you're exposed
Ignition is installed as a gateway service, so the quickest check is the version shown on the gateway's own web page, plus the Designer and Vision Client versions on any workstation that connects to it. Write down every gateway, including test and edge gateways that people forget about.
Then compare each version with the fixed release named in the vendor's security advisory. If the advisory does not name a version for your release line, ask Inductive Automation support rather than guessing.
A dependency scanner will not see this one, because Ignition is a vendor product and not a package in your repository. Track it in your asset inventory instead, with its version and where it is reachable from.
What to do now
- Open the Inductive Automation security advisory linked below and find the fixed release for your Ignition line.
- Upgrade to the fixed release. Do this first on workstations whose users connect to servers they do not control.
- Tell engineers and integrators to connect only to gateways you own, until the update is rolled out.
- Record the version in your asset inventory.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. A program takes data from an outside source and rebuilds objects from it without first checking that the data is safe. If the rebuilt objects can trigger actions, whoever controls the data can influence what the program does. The record says the flaw lies in a lack of proper validation of user supplied data within ResponseParser.
The impact in the record is code execution in the context of the current user. That is serious on an engineering workstation that holds project files and network access to plant systems. KEV status for this CVE is false, and neither the record nor the ZDI advisory claims exploitation.
Industrial software like this often sits outside normal patch cycles. Safeguard's Gold directory tracks the CVE and its weakness class, and the free scan at gold.safeguard.sh/scan covers the open source packages in your own repositories, which is where most teams find the rest of their exposure.
Quick check
Does an attacker need an account?
The record and ZDI describe a remote attacker who needs no privileges, but the target has to take an action: connect to a malicious server. That is what the UI:R in the vector means.
Is this exploited in the wild?
The KEV flag in the record is false, and the sources I read do not say it is being exploited. Patch on a normal but prompt schedule.
Sources
Last reviewed: 19 October 2026.
