CVE-2023-49716 is a medium severity (CVSS 6.9) command injection flaw in Emerson Rosemount GC370XA, GC700XA and GC1500XA gas chromatographs. An authenticated user with network access could run commands remotely. Emerson recommends updating firmware beyond 4.1.5 and keeping the devices off the internet.
What's affected
CISA advisory ICSA-24-030-01 lists the Rosemount GC370XA, GC700XA and GC1500XA at firmware version 4.1.5 and all prior revisions. The weakness is CWE-77 (command injection). The vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H, which means adjacent network access and high attack complexity.
Note that the NVD vector shows no privileges required, while the description says an authenticated user is needed. The advisory and record agree on the 6.9 score. Treat the description as the safer reading and plan for both.
Fixed versions: the advisory does not give a number. It says to contact Emerson Tech Support at GC.CSC@emerson.com for update information.
How to check if you're exposed
Read the firmware version on each unit through its local display or management interface, and compare it with 4.1.5. Any unit at 4.1.5 or older is in scope.
Then map network exposure. These instruments should sit on a protected control network, with no route from business networks or the internet. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- List all GC370XA, GC700XA and GC1500XA units and their firmware versions.
- Contact Emerson Tech Support for the current firmware and apply it in a planned maintenance window.
- Keep devices off the internet and behind firewalls, separated from business networks.
- Use updated VPNs for remote access.
- Review which accounts can log in to the units and remove unused ones.
- Record the firmware version and update date for each unit, so the next advisory takes minutes to answer.
Why it matters
Command injection happens when input meant as data reaches a system shell as instructions. On an instrument controller, that can affect integrity and availability of readings and operations, which the vector scores as low and high respectively.
Industrial devices change slowly, and patch windows are rare, sometimes a single planned outage each year. Plan for that cadence rather than hoping to patch the week an advisory lands. Network separation is the control that works in the meantime. This CVE is not on the CISA KEV list.
Quick check
Which firmware is affected?
Version 4.1.5 and all prior revisions, per the CISA advisory.
Who supplies the fix?
Emerson. The advisory points to its tech support contact for update details.
Sources
Last reviewed: 19 October 2026.
