CVE-2023-39473: 
NixOS vulnerability analysis and mitigation

A remote code execution vulnerability was identified in Inductive Automation Ignition's AbstractGatewayFunction class, tracked as CVE-2023-39473. The vulnerability was discovered on June 6, 2022, and publicly disclosed on August 8, 2023, as a zero-day vulnerability. The flaw affects Inductive Automation Ignition installations and requires authentication for exploitation (Zero Day Initiative).

The vulnerability stems from improper validation of user-supplied data within the AbstractGatewayFunction class, leading to deserialization of untrusted data. It has been assigned a CVSS v3.0 base score of 8.8 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) (Zero Day Initiative).

When successfully exploited, this vulnerability allows authenticated remote attackers to execute arbitrary code in the context of SYSTEM on affected Inductive Automation Ignition installations (Zero Day Initiative).

The vulnerability requires authentication for exploitation and can be accessed remotely. The attack complexity is considered low, requiring no user interaction for successful exploitation (Zero Day Initiative).

According to the security advisory, the only effective mitigation strategy is to restrict interaction with the application. Despite multiple follow-ups with the vendor between June 2022 and July 2023, no patch was made available at the time of disclosure (Zero Day Initiative).

The vulnerability was initially reported to Inductive Automation on June 6, 2022. Despite multiple communications and the vendor acknowledging active development of a fix, the lack of a patch led to Zero Day Initiative publishing a zero-day advisory on August 8, 2023 (Zero Day Initiative).