Risk Summary
Successful exploitation of this vulnerability could cause the system to change to halt-mode, resulting in a denial-of-service condition.
CVEs (1)
Remediations
- Emerson has acquired the affected products from GE. All inquiries should be directed to Emerson:1-888-565-4155;1-434-214-8532 (if toll free 800 option is unavailable);Tech Support:[email protected],mailto:[email protected];Sales/Order Support: [email protected],mailto:[email protected];',empty icsa-20-014-01.json,vendor_fix,Version R9.85 CPE100 - Upgrade Kit: 41G2393-MS10-000-A5.zip,https://digitalsupport.ge.com/en_US/Article/EPSCPE100-Landing-Page icsa-20-014-01.json,vendor_fix,Version R9.85 CPE115 - Upgrade Kit: 41G2556-MS10-000-A2.zip,https://digitalsupport.ge.com/en_US/Article/EPSCPE115-Landing-Page icsa-20-014-01.json,vendor_fix,Version R9.90 CPE302 - Upgrade Kit: CPE302_FW9_90_41G2552-FW01-000-A3.zip,https://digitalsupport.ge.com/communities/en_US/Download/IC695CPE302-PACSystems-RX3i-CPU-Firmware icsa-20-014-01.json,vendor_fix,Version R9.90 CPE305 - Upgrade Kit: CPE305_FW9_90_41G1733-MS10-000-A20.zip,https://digitalsupport.ge.com/communities/en_US/Download/IC695CPE305-PACSystems-RX3i-CPU-DN icsa-20-014-01.json,vendor_fix,Version R9.90 CPE310 - Upgrade Kit: CPE310_FW9_90_41G1734-MS10-000-A20.zip,https://digitalsupport.ge.com/communities/en_US/Download/IC695CPE310-PACSystems-RX3i-CPU-DN icsa-20-014-01.json,vendor_fix,Version R9.90 CPE330 - Upgrade Kit: CPE330_FW9_90_41G2016-FW01-000-A16.zip,https://digitalsupport.ge.com/communities/en_US/Download/IC695CPE330-PACSystems-RX3i-CPU-DN icsa-20-014-01.json,vendor_fix,Version R9.90 CPE400 - Upgrade Kit: CPE400_FW9_90_41G2376-FW01-000-A7.zip,https://digitalsupport.ge.com/communities/en_US/Download/IC695CPE400-PACSystems-RX3i-Rackless-CPU-with-Field-Agent icsa-20-014-01.json,vendor_fix,Version R9.90 CPL410 - Upgrade Kit: CPL410_FW9_90_41G2617-FW01-000-A3.zip,https://digitalsupport.ge.com/communities/en_US/Download/IC695CPL410-PACSystems-RX3i-Rackless-CPU-with-Linux icsa-20-014-01.json,vendor_fix,Emerson notes that CPU/CRU320 has reached end of life. They recommend users upgrade to CPE330.,empty icsa-22-265-01.json,vendor_fix,Measuresoft recommends the following steps to remove full access to the ORCHESTRATOR service:,empty icsa-22-265-01.json,vendor_fix,Open a command-line window (CMD) with 'run as administrator',empty icsa-22-265-01.json,vendor_fix,Use the following command to make the permission change to the ORCHESTRATOR service: sc sdset ORCHESTRATOR D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU),empty icsa-22-265-01.json,vendor_fix,As a low-level user attempt to shut down the ORCHESTRATOR service: sc stop ORCHESTRATOR. User will be denied. It will no longer be possible to edit the configuration of the service by a low-level user.'
Affected Vendors
General Electric (GE) and Emerson
Affected Products (9)
General Electric (GE) and Emerson
·
CPE310
< R9.90
General Electric (GE) and Emerson
·
CPE100
< R9.85
General Electric (GE) and Emerson
·
CPE305
< R9.90
General Electric (GE) and Emerson
·
CPL410
< R9.90
General Electric (GE) and Emerson
·
CRU320
vers:all/*
General Electric (GE) and Emerson
·
CPE115
< R9.85
General Electric (GE) and Emerson
·
CPE330
< R9.90
General Electric (GE) and Emerson
·
CPE400
< R9.90
General Electric (GE) and Emerson
·
CPE302
< R9.90
Affected Sectors
Commercial Facilities, Critical Manufacturing, Dams, Defense Industrial Base, Energy, Food and Agricultural, Government Facilities, Information Technology, Transportation Systems, Water and Wastewater Systems
Get alerted to advisories like this
OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.
Start free trial Learn more