CVE-2023-46687
Assigner: icscert
Published: 2024-02-09T03:49:28.352Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Rosemount GC370XA
vendor: Emerson
versions: lessThanOrEqual: Version 4.1.5
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: Rosemount GC700XA
vendor: Emerson
versions: lessThanOrEqual: Version 4.1.5
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: Rosemount GC1500XA
vendor: Emerson
versions: lessThanOrEqual: Version 4.1.5
status: affected
version: 0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Vera Mens of Claroty Research reported these vulnerabilities to Emerson.
datePublic: 2024-01-30T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.</span>

</span>


value: 


In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.




metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-77
description: CWE-77 Command Injection
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Emerson recommends end users update the affected products' firmware. For update information, contact </span><a target="_blank" rel="nofollow">Emerson Tech Support</a><span style="background-color: rgb(255, 255, 255);">. Emerson recommends end users continue to use current cybersecurity industry best practices, and in the event such infrastructure is not implemented within an end user's network, the user should take action to ensure the affected product is connected to a well-protected network and not connected to the Internet. For more information, refer to the </span><a target="_blank" rel="nofollow" href="https://www.emerson.com/en-us/support/security-notifications">Emerson Security</a><span style="background-color: rgb(255, 255, 255);">&nbsp;web page.</span>

<br>
value: 
Emerson recommends end users update the affected products' firmware. For update information, contact  Emerson Security https://www.emerson.com/en-us/support/security-notifications  web page.



source: advisory: ICSA-24-030-01
discovery: EXTERNAL
title: Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection
x_generator: engine: Vulnogram 0.1.0-dev