CVE-2023-39475

The vulnerability exists in the ParameterVersionJavaSerializationCodec class, which improperly validates user-supplied data before deserialization. An attacker can send a specially crafted payload over the network that will be deserialized without any verification. Code execution occurs in the context of the SYSTEM account, which means the highest privilege level in the Windows operating system.

The attacker gains the ability to execute arbitrary code with SYSTEM privileges on the targeted machine, resulting in complete system takeover, including data access, software installation, and further lateral movement in the network.

Apply patches available from the vendor according to the references provided. It is also recommended to restrict network access to Ignition installations using a firewall and to segment industrial networks (OT/ICS) to reduce the attack surface until the patch is deployed.

Inductive Automation Ignition — versions indicated in the vendor references and in the ZDI-23-1047 advisory