Security readout for executives and security teams
Plain-English summary
This CVE affects Emerson Rosemount GC370XA, GC700XA, and GC1500XA gas chromatograph products. A network-adjacent, unauthenticated attacker could bypass authentication and gain administrator capabilities. For operators, the concern is unauthorized control or access to industrial equipment, not broad internet exploitation proven by the supplied sources.
Executive priority
Treat this as high priority for OT sites using the named gas chromatographs. The business urgency is strongest where these devices support production, custody transfer, quality, or safety-adjacent operations and are reachable from shared networks.
Technical view
The issue is improper authentication, mapped to CWE-863. The CVSS 3.1 score is 8.3 with adjacent-network access, high attack complexity, no privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Likely exposure is limited to environments running the named Emerson Rosemount GC370XA, GC700XA, or GC1500XA products where an attacker can reach the device over the relevant local or adjacent network. The supplied data does not define affected firmware ranges beyond the provided version value.
Exploitation context
The bundle does not show CISA KEV listing or any cited evidence of active exploitation. Exploitation is described as requiring unauthenticated network access and could result in administrator capabilities, but no exploit maturity or public weaponization evidence is provided.
Researcher notes
The source bundle supports authentication bypass to admin capability, CWE-863, and CVSS 8.3. It does not provide exploit details, patch identifiers, firmware ranges, or active exploitation evidence. Further analysis should start with the Emerson PDF and CISA advisory.
Mitigation direction
- Review Emerson’s security notification and CISA ICSA-24-030-01 for official remediation guidance.
- Inventory Rosemount GC370XA, GC700XA, and GC1500XA deployments.
- Restrict network reachability to trusted OT management paths only.
- Apply vendor-approved updates or compensating controls if specified by Emerson.
- Monitor administrative access and configuration changes on affected systems.
Validation and detection
- Confirm whether the named Emerson models exist in production or lab networks.
- Verify network paths that can reach device management or control interfaces.
- Check installed versions against Emerson and CISA advisory details.
- Review logs for unexpected administrator sessions or configuration changes.
- Document any vendor mitigation status and residual exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-51761 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H1.66Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.3HighVector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.