CVE-2023-39476

The vulnerability lies in the JavaSerializationCodec class, which does not perform proper validation of user-supplied data. An attacker can send a crafted payload containing malicious serialized Java objects that will be deserialized by the application without appropriate security controls. As a result of this process (deserialization of untrusted data), arbitrary code execution is possible in the context of the SYSTEM account on the targeted machine.

The attacker gains the ability to execute arbitrary code with SYSTEM privileges, which means complete control over the operating system, including data access, the ability to install malicious software, and lateral movement across the network.

Apply patches available from the vendor in accordance with the references (https://www.zerodayinitiative.com/advisories/ZDI-23-1046/). Additionally, it is recommended to restrict network access to Ignition instances only to trusted hosts and to implement network segmentation in OT/SCADA environments.

Inductive Automation Ignition — versions indicated in the vendor's references (ZDI-CAN-20291 / ZDI-23-1046)