CVE-2023-46687 is a critical severity (CVSS 9.8) command injection in Emerson Rosemount GC370XA, GC700XA and GC1500XA gas chromatographs. An unauthenticated user with network access could run commands as root. CISA lists version 4.1.5 and prior as affected, names no fixed version, and tells owners to update firmware via Emerson support.
What's affected
The CISA ICS advisory ICSA-24-030-01 lists the GC370XA, GC700XA and GC1500XA at version 4.1.5 and all prior revisions. The advisory does not name a fixed version. It tells owners to update the firmware and to contact Emerson Tech Support for update information.
The NVD record lists the GC370XA and GC700XA firmware at 4.1.5. The advisory also includes the GC1500XA. The vector shows a network attack with no privileges and no user action. The weakness is CWE-77. CISA is not quoted as saying it is exploited, and the record is not in KEV.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-77 (command injection). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Read the firmware version from the instrument's configuration software or local display and compare it with 4.1.5. If you cannot tell, ask Emerson Tech Support. Then map how each unit is connected: whether it is on a business network, reachable by remote access, or exposed to the internet.
The CISA guidance asks asset owners to keep these devices on a well protected network, away from the internet.
What to do now
- Contact Emerson Tech Support for the firmware update and apply it in a maintenance window.
- Keep the units off the internet and isolate them behind firewalls away from business networks.
- Use a current VPN for any required remote access.
- Do an impact analysis and risk assessment before deploying defences, as CISA advises.
- Log which units are at which firmware level.
Why it matters
In industrial settings, the instrument that measures gas composition feeds process decisions. Root command execution without a login means anyone on the same network can take control of it. Control system devices often live for decades and are rarely patched, so network isolation does most of the protection.
The score is the maximum allowed by the vector. The practical advice from CISA is network segmentation plus firmware update through the vendor.
Quick check
Is there a published fixed version?
The advisory does not name one. Contact Emerson Tech Support.
Is it exploited?
CISA does not say so in what we read, and the record is not in KEV.
Sources
Last reviewed: 19 October 2026.
