{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2025-9038",
        "assignerOrgId": "2cf0fb33-79e2-44e0-beb8-826cc5ce3250",
        "state": "PUBLISHED",
        "assignerShortName": "GE_Vernova",
        "dateReserved": "2025-08-14T13:30:30.722Z",
        "datePublished": "2025-09-22T14:49:38.805Z",
        "dateUpdated": "2025-09-24T13:31:23.806Z"
    },
    "containers": {
        "cna": {
            "title": "S1 Agile Privilege Escalation",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "type": "CWE",
                            "cweId": "CWE-269",
                            "description": "CWE-269 Improper Privilege Management"
                        }
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version."
                }
            ],
            "affected": [
                {
                    "vendor": "GE Vernova",
                    "product": "S1 Agile Configuration Software",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "3.1 and previous version",
                            "status": "affected"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://www.gevernova.com/grid-solutions/sites/default/files/resources/products/support/ges-2025-001.pdf"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Charit Misra from DNV, Netherlands"
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-233",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-233 Privilege Escalation"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NEGLIGIBLE",
                        "attackComplexity": "HIGH",
                        "attackRequirements": "PRESENT",
                        "attackVector": "LOCAL",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH",
                        "privilegesRequired": "NONE",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "NONE",
                        "subConfidentialityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "HIGH",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "HIGH",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "To resolve this issue and enhance security, during the S1 Agile application installation, we ensure \nonly privileged users can access various folders used by the S1 Agile application. This ensures \nthat S1 Agile files can not be edited or replaced by users without sufficient privileges on that \ncomputer. <br><br>\nWe would like to assert that this attack, if successful, can give “Administrator” privileges to the \nattacker on the computer, but the configured IEDs will not see any impact in their configuration or \nfunctionality. The RBAC (‘Role-Based Access Control’) on the IED remains unimpacted. \n\n<br><br>\n\nWe strongly recommend customers to upgrade to the latest software version available. \nSoftware version 3.1.1 is released for customer usage in January 2025. \n\n<br>"
                        }
                    ],
                    "value": "To resolve this issue and enhance security, during the S1 Agile application installation, we ensure \nonly privileged users can access various folders used by the S1 Agile application. This ensures \nthat S1 Agile files can not be edited or replaced by users without sufficient privileges on that \ncomputer. \n\n\nWe would like to assert that this attack, if successful, can give “Administrator” privileges to the \nattacker on the computer, but the configured IEDs will not see any impact in their configuration or \nfunctionality. The RBAC (‘Role-Based Access Control’) on the IED remains unimpacted. \n\n\n\n\n\nWe strongly recommend customers to upgrade to the latest software version available. \nSoftware version 3.1.1 is released for customer usage in January 2025."
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "As a workaround, GE Vernova recommends having sufficient security controls in place on the \nworkstation where S1 Agile software is installed. This will ensure the attacker’s remote \nconnection to the computer is not feasible. Harden the computer on which S1 Agile is installed. \nThe product deployment guide can be used to understand the guidelines around how the product \ncan be deployed in the end user’s environment. \n\n<br>"
                        }
                    ],
                    "value": "As a workaround, GE Vernova recommends having sufficient security controls in place on the \nworkstation where S1 Agile software is installed. This will ensure the attacker’s remote \nconnection to the computer is not feasible. Harden the computer on which S1 Agile is installed. \nThe product deployment guide can be used to understand the guidelines around how the product \ncan be deployed in the end user’s environment."
                }
            ],
            "x_generator": {
                "engine": "cveClient/1.0.15"
            },
            "providerMetadata": {
                "orgId": "2cf0fb33-79e2-44e0-beb8-826cc5ce3250",
                "shortName": "GE_Vernova",
                "dateUpdated": "2025-09-24T13:31:23.806Z"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-09-22T16:54:16.367027Z",
                                "id": "CVE-2025-9038",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-09-22T17:26:59.035Z"
                }
            }
        ]
    }
}