CVE-2023-39477 – This vulnerability allows unauthenticated remot... (How to Fix)

Q: What is the severity of CVE-2023-39477?

CVE-2023-39477 has a CVSS score of 7.5 (HIGH). This vulnerability allows unauthenticated remote attackers to cause denial-of-service by sending excessive OPC UA ConditionRefresh requests to Inductive Automation Ignition servers, consuming all available resources. All affected Ignition installations are vulnerable without authentication.

📋 TL;DR

This vulnerability allows unauthenticated remote attackers to cause denial-of-service by sending excessive OPC UA ConditionRefresh requests to Inductive Automation Ignition servers, consuming all available resources. All affected Ignition installations are vulnerable without authentication.

💻 Affected Systems

Products:

Inductive Automation Ignition

Versions: Versions prior to 8.1.33

Operating Systems: All supported platforms

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations are vulnerable. No special configuration required for exploitation.

📦 What is this software?

Ignition by Inductiveautomation

View all CVEs affecting Ignition →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system unavailability with resource exhaustion causing service disruption to all connected industrial control systems and clients.

🟠

Likely Case

Service degradation or temporary outage affecting industrial operations until system restart.

🟢

If Mitigated

Minimal impact with proper network segmentation and rate limiting in place.

🌐 Internet-Facing: HIGH - Unauthenticated remote exploitation makes internet-facing systems particularly vulnerable.

🏢 Internal Only: MEDIUM - Internal attackers can still exploit, but requires network access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple resource exhaustion attack requiring only network access to OPC UA port.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 8.1.33

Vendor Advisory: https://inductiveautomation.com/downloads/releasenotes/8.1.33

Restart Required: Yes

Instructions:

1. Download Ignition 8.1.33 from vendor portal. 2. Backup current installation. 3. Run installer to upgrade. 4. Restart Ignition services.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict access to Ignition OPC UA ports (typically 49320) to trusted networks only.

Rate Limiting

all

Implement network-level rate limiting for OPC UA traffic to prevent request flooding.

🧯 If You Can't Patch

Implement strict network access controls to limit OPC UA port exposure
Deploy intrusion prevention systems with DoS protection rules

🔍 How to Verify

Check if Vulnerable:

Check Ignition version in Gateway Web Interface under Status > About. If version is below 8.1.33, system is vulnerable.

Check Version:

Check Gateway Web Interface at http://[ignition-server]:8088/main/system/about

Verify Fix Applied:

Confirm version shows 8.1.33 or higher in Gateway Web Interface and test OPC UA connectivity remains functional.

📡 Detection & Monitoring

Log Indicators:

High frequency of OPC UA ConditionRefresh requests
Resource exhaustion warnings in system logs
Unusual spike in CPU/memory usage

Network Indicators:

Excessive traffic to OPC UA port 49320
Multiple rapid ConditionRefresh requests from single source

SIEM Query:

source="ignition.log" AND "ConditionRefresh" | stats count by src_ip | where count > 100

📊 Metadata

CVE ID: CVE-2023-39477

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

Published: May 3, 2024

Last Updated: March 12, 2025

🔗 References

https://inductiveautomation.com/downloads/releasenotes/8.1.33 Release Notes
https://www.zerodayinitiative.com/advisories/ZDI-23-1050/ Third Party Advisory
https://inductiveautomation.com/downloads/releasenotes/8.1.33 Release Notes
https://www.zerodayinitiative.com/advisories/ZDI-23-1050/ Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-39477, you might also want to check these: