Emerson Rosemount GC370XA, GC700XA, GC1500XA

🗓️ 30 Jan 2024 07:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 38 Views

Emerson Rosemount GC370XA, GC700XA, and GC1500XA have multiple vulnerabilities including command injection, improper authentication, and authorization. Exploitation can lead to arbitrary command execution, bypassing authentication, sensitive info access, and DoS.

Reporter	Title	Published	Views	Family All 44
BDU FSTEC	The vulnerability of microprogrammed software in Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a perpetrator to execute arbitrary code.	31 Jan 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software for Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs lies in the lack of measures taken to neutralize special elements used in the operating system’s command set, allowing attackers to execute arbitrary commands.	6 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA flow gas analyzers is related to deficiencies in authentication procedures. This allows attackers to compromise data integrity and cause service failures.	14 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs is caused by deficiencies in the authentication process, which allows unauthorized access to confidential information or causes service failures.	20 Feb 202400:00	–	bdu_fstec
Circl	CVE-2023-43609	9 Feb 202405:31	–	circl
Circl	CVE-2023-46687	9 Feb 202405:31	–	circl
Circl	CVE-2023-49716	9 Feb 202405:31	–	circl
Circl	CVE-2023-51761	9 Feb 202405:31	–	circl
CNNVD	Emerson Rosemount GC370XA, GC700XA, GC1500XA License Issue Vulnerability	9 Feb 202400:00	–	cnnvd
CNNVD	Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection Vulnerabilities	9 Feb 202400:00	–	cnnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-030-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-24-030-01
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
cisa	www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
cisa	www.cisa.gov/uscert/ncas/tips/ST04-014

30 Jan 2024 07:00Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.00936

SSVC