Lucene search

IcscertVULNRICHMENT:CVE-2023-43609

HistoryFeb 09, 2024 - 3:52 a.m.

CVE-2023-43609 Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authorization

2024-02-0903:52:03

CWE-285

icscert

github.com

emerson

rosemount

gc370xa

gc700xa

gc1500xa

improper authorization

sensitive information

denial of service

CVSS3

6.9

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition.

CNA Affected

[
  {
    "vendor": "Emerson",
    "product": "Rosemount GC370XA",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "Version 4.1.5"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Emerson",
    "product": "Rosemount GC700XA",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "Version 4.1.5"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Emerson",
    "product": "Rosemount GC1500XA",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "Version 4.1.5"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-030-01

www.emerson.com/documents/automation/security-notification-emerson-gas-chromatographs-cyber-security-notification-icsa-24-030-01-en-10103910.pdf

CVSS3

6.9

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-43609