CVE-2023-50232 is a High severity (CVSS 8.8) argument injection flaw in Inductive Automation Ignition. The getParams method uses an unchecked string when preparing an argument for a system call, which can lead to code execution as the current user. Update to the fixed release in the vendor advisory.
What's affected
Product: Inductive Automation Ignition, with no version range in the record. ZDI published ZDI-24-184 on 21 February 2024, and NVD published the record on 3 May 2024.
I could not confirm a fixed version number from the pages I fetched. The ZDI advisory says Inductive Automation has issued an update, and points to the vendor security page, which loaded as a general trust center without a per-CVE version table. Treat the vendor advisory as the source of truth for the exact fixed release.
The vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. As with the other Ignition client side bugs, ZDI says the target must connect to a malicious server. The risk therefore falls on people who launch Ignition tools against servers outside your control, such as integrators and contractors.
How to check if you're exposed
Ignition is installed as a gateway service, so the quickest check is the version shown on the gateway's own web page, plus the Designer and Vision Client versions on any workstation that connects to it. Write down every gateway, including test and edge gateways that people forget about.
Then compare each version with the fixed release named in the vendor's security advisory. If the advisory does not name a version for your release line, ask Inductive Automation support rather than guessing.
A dependency scanner will not see this one, because Ignition is a vendor product and not a package in your repository. Track it in your asset inventory instead, with its version and where it is reachable from.
What to do now
- Open the Inductive Automation security advisory linked below and find the fixed release for your Ignition line.
- Upgrade gateways, Designer installs and client launchers to that release, starting with systems that are reachable from less trusted networks.
- Record the new version in your asset inventory and remove old installers from shared drives so nobody reinstalls the vulnerable build.
- Ask anyone who uses Ignition tools from a laptop to confirm which servers they connect to, and to update first.
Why it matters
The weakness is CWE-88, argument injection. A program builds a command line for a system call and includes a string supplied from outside, without checking it. If the string can add or change arguments, the called program may do something other than what the author intended. ZDI states that the flaw is in getParams, where the string is used to prepare an argument for a system call.
This differs from classic command injection, where a whole new command is run. Here the attacker changes how a legitimate program is invoked, which can still be enough for code execution depending on that program's options. The record sums up the result as code execution in the context of the current user.
KEV is false, and I found no claim of exploitation. Related Ignition findings from the same period include CVE-2023-50233, a directory traversal in a nearby method, so it is worth patching them together.
Quick check
Do I need to expose the gateway to the internet to be at risk?
The advisory describes a user connecting to a malicious server. Exposure of your own gateway is not the main condition. Control over what the client connects to is.
Is there a workaround?
None is described in the sources I read. The fix is the vendor update.
Sources
Last reviewed: 19 October 2026.
