CVE-2023-43609 is a medium severity (6.9) incorrect authorization flaw in Emerson Rosemount GC370XA, GC700XA and GC1500XA gas chromatographs. An unauthenticated user with network access could read sensitive data or cause denial of service. The advisory names no fixed version, so contact Emerson.
What's affected
CISA advisory ICSA-24-030-01 lists the Rosemount GC370XA, GC700XA and GC1500XA at firmware version 4.1.5 and earlier. The advisory does not name a fixed version. It says Emerson recommends updating the firmware and tells users to contact Emerson Tech Support for update information.
CISA and NVD both give a base score of 6.9 (Medium). The vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H. In plain terms the attack is made from an adjacent network, such as the same Wi-Fi or local segment, attack complexity is high, it needs no privileges, and it needs no user interaction. Impact on confidentiality is no, on integrity low and on availability high. The scope is changed, meaning the flaw can affect components beyond the one that contains it.
The weakness is tagged CWE-863.
How to check if you're exposed
There is no package manager command for this product. Check the firmware version on the instrument itself or through the vendor tool you use to manage it, and compare it with 4.1.5. Then check network reachability from the outside:
nmap -sT -Pn -p 1-1024 YOUR_INSTRUMENT_IP
Run that only against devices you own and only from a network position where you are allowed to scan. Industrial devices can be fragile, so schedule it and keep the scan light. If an instrument answers from a business network or the internet, that is already a finding.
What to do now
- Inventory every Rosemount GC370XA, GC700XA and GC1500XA and record the firmware version of each.
- Contact Emerson Tech Support at the address in the advisory to ask for the update path for any unit running 4.1.5 or earlier.
- Make sure the instruments are not reachable from the internet, and place them behind a firewall that separates control networks from business networks.
- If remote access is needed, use a current VPN and remember CISA's note that a VPN is only as secure as the devices connected to it.
- Assess impact and risk before you change anything on a running process, and follow your own change procedures.
Why it matters
CWE-863 is incorrect authorization. The code does not properly check that the caller is allowed to perform the action.
In this case the product lets someone on the network reach functions or data without being properly checked. The record says an unauthenticated user with network access could obtain sensitive information or cause a denial of service. The vector marks attack complexity as high and the attack as adjacent network, which narrows who can do it, but gas chromatographs often feed process decisions, so lost availability has real cost.
The record does not mark this CVE as a CISA Known Exploited Vulnerability, and the advisory we read does not report exploitation.
Quick check
Is there a patch?
The CISA advisory does not name a fixed version. Emerson recommends updating firmware and asks users to contact its support team.
What reduces risk if I cannot update yet?
Keep the instruments off the internet, segment them behind a firewall and restrict who on the network can reach them.
Sources
- CISA ICS advisory ICSA-24-030-01
- Emerson security notification (linked from the record)
- NVD record for CVE-2023-43609
Last reviewed: 19 October 2026.
