CVE-2023-50223

What it actually does

CVE-2023-50223 is a deserialization of untrusted data vulnerability in the ExtendedDocumentCodec class of Inductive Automation Ignition. An authenticated remote attacker with low privileges can submit crafted serialized data that is insufficiently validated, causing the Ignition gateway to deserialize attacker-controlled content and execute arbitrary code. Successful exploitation can result in code execution as SYSTEM on Windows installations, giving the attacker full control of the affected host and potentially the ability to manipulate industrial automation services managed by Ignition.

Why it matters to the business

A successful attack can give an intruder complete control of an Ignition server, which may affect plant operations, supervisory control, data collection, reporting, integrations, and availability of industrial services. Because exploitation requires only network access and a valid low-privileged account, compromised user credentials or weak account hygiene can turn this into a high-impact operational risk. The EPSS score indicates a meaningful likelihood of exploitation activity compared with many vulnerabilities, even though it is not currently listed in CISA KEV and no ransomware-specific KEV association is reported.

How an attack unfolds

An attacker first obtains valid credentials for an Ignition deployment, such as through phishing, password reuse, exposed credentials, or compromise of a low-privileged account. The attacker then connects to the Ignition service over the network and reaches functionality that uses ExtendedDocumentCodec to process user-supplied serialized content. By submitting a specially crafted payload, the attacker triggers unsafe deserialization. If the payload is accepted and processed by the vulnerable code path, the Ignition process executes attacker-controlled code. On affected Windows installations, that code may run in the context of SYSTEM, allowing the attacker to install tools, create accounts, dump credentials, pivot to adjacent systems, disrupt services, or tamper with operational workflows.

How to fix it

Upgrade Inductive Automation Ignition to a vendor-fixed release as soon as possible. If exact fixed versions are not available in the asset inventory, consult Inductive Automation’s advisory and release notes for CVE-2023-50223 and update all affected gateway, redundant gateway, development, staging, and disaster recovery instances. Until patching is complete, restrict network access to Ignition services to trusted administrative and operational networks, enforce strong authentication and least privilege for Ignition accounts, disable or remove unnecessary accounts, monitor for unusual authenticated activity, and place additional controls around remote access paths such as VPNs, jump hosts, and identity providers. Avoid exposing Ignition management interfaces directly to the internet.

How to confirm the fix worked

Confirm the deployed Ignition version is at or above a vendor-fixed release and that all clustered, redundant, backup, and non-production instances have also been upgraded. Validate that the vulnerable version is no longer present through authenticated product version checks, software inventory, vulnerability scanning, and package or installer records. Review access controls to ensure only authorized users can reach Ignition services. After upgrading, confirm the gateway starts cleanly, projects and integrations operate normally, and no vulnerable legacy nodes remain reachable. Where possible, use a safe, vendor-approved vulnerability check rather than attempting exploit-style validation in production.

Typical attack path

1. Identify an externally reachable or internally accessible Inductive Automation Ignition gateway.
2. Obtain valid Ignition credentials or compromise a low-privileged user account.
3. Authenticate to the target Ignition instance.
4. Send crafted serialized data to functionality that invokes the ExtendedDocumentCodec class.
5. Trigger unsafe deserialization and achieve arbitrary code execution in the Ignition process context.
6. Escalate impact by running commands as SYSTEM, deploying persistence, collecting credentials, moving laterally, or disrupting Ignition-managed operations.

How to detect it

Investigate whether authenticated users accessed Ignition shortly before suspicious process execution, service changes, configuration changes, or unexpected outbound network connections. Review Ignition gateway logs, wrapper/service logs, web access logs, authentication logs, operating system security logs, EDR telemetry, command-line process creation events, scheduled task records, Windows service creation events, PowerShell logs, and network proxy/firewall logs. Focus on unusual successful logins followed by errors or activity referencing ExtendedDocumentCodec, Java deserialization exceptions, unexplained gateway restarts, or Java/Ignition processes spawning operating system shells. On Windows, examine Event ID 4688 for process creation, 7045 for new service installation, 4698 for scheduled task creation, PowerShell 4103/4104 logs, and EDR process trees where Ignition or Java launches cmd.exe, powershell.exe, wscript.exe, certutil.exe, bitsadmin.exe, rundll32.exe, or other administrative tools. On Linux, review shell history, systemd unit changes, cron modifications, suspicious child processes of the Ignition Java service, and unexpected writes to temporary directories. Because public, vulnerability-specific IOCs may be limited, detection should emphasize behavior: authenticated access followed by code execution from the Ignition process, privilege use as SYSTEM/root, persistence creation, credential access, and lateral movement.

• ExtendedDocumentCodec
• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.io.ObjectInputStream
• deserialization
• IgnitionGateway -> cmd.exe
• IgnitionGateway -> powershell.exe
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java.exe -> wscript.exe
• java.exe -> cscript.exe
• java.exe -> rundll32.exe
• java.exe -> certutil.exe
• java.exe -> bitsadmin.exe
• java.exe -> net.exe
• java.exe -> net1.exe
• java.exe -> schtasks.exe
• java.exe -> sc.exe
• Event ID 7045
• Event ID 4688
• Event ID 4698
• PowerShell Event ID 4104
• PowerShell Event ID 4103

What your security team should do

• Prioritize patching internet-facing or broadly reachable Ignition gateways first, followed by internal production, staging, backup, and disaster recovery systems.
• Audit Ignition accounts for least privilege, stale users, shared credentials, weak passwords, and recent suspicious logins.
• Restrict access to Ignition administrative and gateway interfaces using network segmentation, VPN, jump hosts, firewall allowlists, and identity-aware access controls.
• Hunt for evidence of post-exploitation activity from the Ignition service account or Java process, especially command shells, PowerShell, new services, scheduled tasks, credential dumping tools, and unexpected outbound connections.
• Review recent authentication logs for successful logins from unusual users, IP addresses, geographies, times, or automation clients.
• Ensure endpoint detection and response coverage is active on Ignition servers and that alerts are tuned for suspicious child processes spawned by Java or Ignition services.
• Back up Ignition configurations and projects, protect backups from modification, and test restoration procedures.
• Because the vulnerability has a high impact and a notable EPSS score, treat exposure as urgent even though it is not currently listed in CISA KEV.