CVE-2023-50223 is a High severity (CVSS 8.8) deserialization of untrusted data flaw in Inductive Automation Ignition. It lives in the ExtendedDocumentCodec class and needs a logged in attacker, but can give code execution as SYSTEM. Inductive Automation has issued an update, so install the fixed release.
What's affected
Product: Inductive Automation Ignition. The record gives no version range. ZDI published the advisory as ZDI-24-018 on 5 January 2024, and NVD published the record on 3 May 2024.
I could not confirm a fixed version number from the pages I fetched. The ZDI advisory says Inductive Automation has issued an update, and points to the vendor security page, which loaded as a general trust center without a per-CVE version table. Treat the vendor advisory as the source of truth for the exact fixed release.
The CVSS 3.1 vector in the ZDI advisory is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which means a low privilege account over the network is enough, with no user interaction. That is different from the sibling Ignition deserialization bug CVE-2023-50222, which needs a victim to connect to a hostile server.
How to check if you're exposed
Ignition is installed as a gateway service, so the quickest check is the version shown on the gateway's own web page, plus the Designer and Vision Client versions on any workstation that connects to it. Write down every gateway, including test and edge gateways that people forget about.
Then compare each version with the fixed release named in the vendor's security advisory. If the advisory does not name a version for your release line, ask Inductive Automation support rather than guessing.
A dependency scanner will not see this one, because Ignition is a vendor product and not a package in your repository. Track it in your asset inventory instead, with its version and where it is reachable from.
What to do now
- Open the Inductive Automation security advisory linked below and find the fixed release for your Ignition line.
- Upgrade every gateway to that release. Prioritise gateways that many people can log in to.
- Review who holds accounts on each gateway. Remove accounts that are unused and avoid shared logins.
- Limit network access to the gateway to the hosts and subnets that need it.
- Record the version in your asset inventory.
Why it matters
The weakness is CWE-502. The advisory describes it as a lack of proper validation of user supplied data in ExtendedDocumentCodec, which results in deserialization of untrusted data. Code that rebuilds objects from attacker controlled bytes can be steered into running behavior its authors never intended.
The context line is the part to read twice: code runs as SYSTEM. On a Windows host that is the highest local privilege, so an account that looked low risk becomes a path to full control of the machine. Authentication is required, but in practice many gateways have broad user lists, shared passwords or integrator accounts that were never cleaned up.
KEV status is false and no source I read claims exploitation. Use the gold.safeguard.sh/scan page for the open source side of your estate, and list Ignition in your own inventory because dependency scanners do not see vendor products.
Quick check
Is a login required?
Yes. ZDI says authentication is required, and the vector shows low privileges. That lowers the risk compared with an anonymous bug, but it does not remove it.
Which version fixes it?
I could not confirm a version number from the pages I fetched. The ZDI advisory says an update has been issued. Check the vendor advisory for your release line.
Sources
Last reviewed: 19 October 2026.
