title: Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection
description:
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.
problem types: CWE-77 Command Injection
affected:
{
defaultStatus: unaffected
product: Rosemount GC370XA
vendor: Emerson
versions:
lessThanOrEqual: Version 4.1.5, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Rosemount GC700XA
vendor: Emerson
versions:
lessThanOrEqual: Version 4.1.5, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Rosemount GC1500XA
vendor: Emerson
versions:
lessThanOrEqual: Version 4.1.5, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Emerson recommends end users update the affected products' firmware. For update information, contact  Emerson Security https://www.emerson.com/en-us/support/security-notifications  web page.