# 0day vulnerabilities in Inductive Automation Ignition

**URL:** <https://forum.inductiveautomation.com/t/0day-vulnerabilities-in-inductive-automation-ignition/77628>\
**Category:** Ignition\
**Tags:** ignition78, ignition79, ignition80, ignition81\
**Created:** [August 9, 2023, 1:27pm UTC](https://forum.inductiveautomation.com/t/0day-vulnerabilities-in-inductive-automation-ignition/77628 "2023-08-09T13:27:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![antonio.sanchez](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@antonio.sanchez](https://forum.inductiveautomation.com/u/antonio.sanchez)\
**Post date:** [August 9, 2023, 1:27pm UTC](https://forum.inductiveautomation.com/t/0day-vulnerabilities-in-inductive-automation-ignition/77628/1 "2023-08-09T13:27:37Z")

</div>

do you know about this?

The critical vulnerabilities are described below:

- The vulnerability has been detected in the JavaSerializationCodec class , due to the lack of proper validation of user-supplied data, which could result in the deserialization of untrusted data. An attacker could execute code in the context of SYSTEM. The identifier CVE-2023-39476 has been assigned for this vulnerability.
- The flaw is in the ParameterVersionJavaSerializationCodec class, originating from the lack of correct validation of user-supplied data, which could result in the deserialization of untrusted data. An attacker could exploit this vulnerability to execute code in the context of SYSTEM. The identifier CVE-2023-39475 has been assigned for this vulnerability.

The other high severity vulnerabilities have been assigned the identifiers CVE-2023-39473, CVE-2023-39474 and CVE-2023-39477.

---

<div class="post-metadata">

**Author:** ![avaughn](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/avaughn/32/38972_2.png) [@avaughn](https://forum.inductiveautomation.com/u/avaughn)\
**Post date:** [August 9, 2023, 1:32pm UTC](https://forum.inductiveautomation.com/t/0day-vulnerabilities-in-inductive-automation-ignition/77628/2 "2023-08-09T13:32:23Z")

</div>

Hello Antonio,

A tech advisory regarding these vulnerabilities can be found at the following link.

> **[Tech Advisory: Regarding the Security Advisories Published by the ZDI on 8...](https://support.inductiveautomation.com/hc/en-us/articles/18333051904653--Tech-Advisory-Regarding-the-Security-Advisories-Published-by-the-ZDI-on-8-August-2023)**
>
> Regarding the Security Advisories Published by the ZDI on 8 August 2023
> On August 8th, 2023, Trend Micro’s Zero Day Initiative (ZDI), the organizers of ICS Pwn2Own, published six security advisorie...