CVE-2023-51761 is an authentication bypass in Emerson Rosemount GC370XA, GC700XA and GC1500XA gas chromatographs. An unauthenticated user with network access can obtain admin capabilities. The record rates it High at 8.3. Emerson advises updating the firmware through its support team and keeping the devices off the internet.
What's affected
The CISA ICS advisory lists three products, each at version 4.1.5 and all prior revisions: GC370XA, GC700XA and GC1500XA. The NVD record's product list names the GC370XA and GC700XA firmware at 4.1.5 only, so there is a small gap between the two sources. Follow the broader CISA list.
Neither source gives a fixed version number. CISA says Emerson recommends that end users update the affected products' firmware, and it points to Emerson Tech Support for update information.
The record gives a CVSS score of 8.3 (High). The CVSS vector reads as follows. The attack needs access to the same or an adjacent network, and the complexity is high. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-863, CWE-287.
How to check if you're exposed
Check the firmware version in the device's own interface, or in your asset inventory, and compare it with 4.1.5. Anything at 4.1.5 or earlier is in scope.
Then check where the devices sit on the network. These are industrial instruments, and the safest state is isolated from the internet and from general office networks. Use your network diagrams or a firewall rule review to confirm that no route exists from untrusted networks to the management ports.
What to do now
- Inventory GC370XA, GC700XA and GC1500XA units and record their firmware versions.
- Contact Emerson Tech Support for the firmware update, as the advisory directs. The advisory does not state a fixed version number.
- Make sure the devices are not reachable from the internet, and place them behind a firewall away from business networks.
- Use a VPN for any remote access, and keep the VPN itself updated.
- Review who has network access to the devices, and log administrative actions where the device allows it.
Why it matters
The record lists two weakness types, incorrect authorization and improper authentication. In plain terms, the device can be convinced that an unauthenticated caller is an administrator. Once that happens, the caller can change settings or run actions that should be limited to trusted operators.
The same CISA advisory covers other flaws in the same products, including command injection, information exposure and denial of service. This CVE is the one about authentication bypass. Fixing the firmware is the way to address the full set, and CISA states that the vulnerabilities are exploitable remotely.
The score reflects an attacker on an adjacent network with high attack complexity. That limits exposure, but it also shows why network segmentation matters. These instruments measure the composition of gas, and a loss of control over their configuration can affect the data operators rely on.
Try it yourself
See how a watch on new advisories surfaces issues like this the day they are published.
Click through it at your own pace, or open it full screen.
Quick check
Is this exploited in the wild?
The record's KEV flag is false and the advisories we read do not claim exploitation.
Is there a patch number?
Not in the sources we read. Emerson points users to its Tech Support for the firmware update.
Sources
Last reviewed: 19 October 2026.
