title: Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection
description:
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer.
problem types: CWE-77 Command Injection
affected:
{
defaultStatus: unaffected
product: Rosemount GC370XA
vendor: Emerson
versions:
lessThanOrEqual: Version 4.1.5, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Rosemount GC700XA
vendor: Emerson
versions:
lessThanOrEqual: Version 4.1.5, status: affected, version: 0, versionType: custom
}
{
defaultStatus: unaffected
product: Rosemount GC1500XA
vendor: Emerson
versions:
lessThanOrEqual: Version 4.1.5, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Emerson recommends end users update the affected products' firmware. For update information, contact  Emerson Security https://www.emerson.com/en-us/support/security-notifications  web page.