CVE-2023-38124
Published: 03 May 2024
Summary
CVE-2023-38124 is a high-severity Exposed Dangerous Method or Function (CWE-749) vulnerability in Inductiveautomation Ignition. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-38124 is a remote code execution vulnerability in Inductive Automation Ignition that stems from exposure of a dangerous function in the OPC UA Quick Client Task Scheduling component of the Ignition Gateway server. The flaw affects installations of the software and carries a CVSS 3.1 score of 8.8. Successful exploitation permits an attacker to run arbitrary code with SYSTEM privileges on the affected system.
An authenticated remote attacker can trigger the exposed function over the network to achieve code execution in the context of the Ignition Gateway process. No user interaction is required beyond valid credentials, and the attack does not rely on special network positioning.
Public advisories from Zero Day Initiative (ZDI-23-1015) and Inductive Automation describe the issue and note the vendor’s participation in coordinated disclosure events such as Pwn2Own to improve Ignition security. The current EPSS score stands at 0.5376 with an identical peak value, indicating sustained rather than newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-41950
Vulnerability details
Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The…
more
specific flaw exists within the Ignition Gateway server. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20541.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.