CVE-2025-9038

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9038", "assignerOrgId": "2cf0fb33-79e2-44e0-beb8-826cc5ce3250", "state": "PUBLISHED", "assignerShortName": "GE_Vernova", "dateReserved": "2025-08-14T13:30:30.722Z", "datePublished": "2025-09-22T14:49:38.805Z", "dateUpdated": "2025-09-24T13:31:23.806Z"}, "containers": {"cna": {"title": "S1 Agile Privilege Escalation", "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "descriptions": [{"lang": "en", "value": "Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version."}], "affected": [{"vendor": "GE Vernova", "product": "S1 Agile Configuration Software", "defaultStatus": "unaffected", "versions": [{"version": "3.1 and previous version", "status": "affected"}]}], "references": [{"url": "https://www.gevernova.com/grid-solutions/sites/default/files/resources/products/support/ges-2025-001.pdf"}], "credits": [{"lang": "en", "type": "reporter", "value": "Charit Misra from DNV, Netherlands"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.5, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "To resolve this issue and enhance security, during the S1 Agile application installation, we ensure \nonly privileged users can access various folders used by the S1 Agile application. This ensures \nthat S1 Agile files can not be edited or replaced by users without sufficient privileges on that \ncomputer. <br><br>\nWe would like to assert that this attack, if successful, can give \u201cAdministrator\u201d privileges to the \nattacker on the computer, but the configured IEDs will not see any impact in their configuration or \nfunctionality. The RBAC (\u2018Role-Based Access Control\u2019) on the IED remains unimpacted. \n\n<br><br>\n\nWe strongly recommend customers to upgrade to the latest software version available. \nSoftware version 3.1.1 is released for customer usage in January 2025. \n\n<br>"}], "value": "To resolve this issue and enhance security, during the S1 Agile application installation, we ensure \nonly privileged users can access various folders used by the S1 Agile application. This ensures \nthat S1 Agile files can not be edited or replaced by users without sufficient privileges on that \ncomputer. \n\n\nWe would like to assert that this attack, if successful, can give \u201cAdministrator\u201d privileges to the \nattacker on the computer, but the configured IEDs will not see any impact in their configuration or \nfunctionality. The RBAC (\u2018Role-Based Access Control\u2019) on the IED remains unimpacted. \n\n\n\n\n\nWe strongly recommend customers to upgrade to the latest software version available. \nSoftware version 3.1.1 is released for customer usage in January 2025."}], "source": {"discovery": "UNKNOWN"}, "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "As a workaround, GE Vernova recommends having sufficient security controls in place on the \nworkstation where S1 Agile software is installed. This will ensure the attacker\u2019s remote \nconnection to the computer is not feasible. Harden the computer on which S1 Agile is installed. \nThe product deployment guide can be used to understand the guidelines around how the product \ncan be deployed in the end user\u2019s environment. \n\n<br>"}], "value": "As a workaround, GE Vernova recommends having sufficient security controls in place on the \nworkstation where S1 Agile software is installed. This will ensure the attacker\u2019s remote \nconnection to the computer is not feasible. Harden the computer on which S1 Agile is installed. \nThe product deployment guide can be used to understand the guidelines around how the product \ncan be deployed in the end user\u2019s environment."}], "x_generator": {"engine": "cveClient/1.0.15"}, "providerMetadata": {"orgId": "2cf0fb33-79e2-44e0-beb8-826cc5ce3250", "shortName": "GE_Vernova", "dateUpdated": "2025-09-24T13:31:23.806Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-22T16:54:16.367027Z", "id": "CVE-2025-9038", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T17:26:59.035Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9038", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-22T16:54:16.367027Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-22T16:54:21.367Z"}}], "cna": {"title": "S1 Agile Privilege Escalation", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Charit Misra from DNV, Netherlands"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GE Vernova", "product": "S1 Agile Configuration Software", "versions": [{"status": "affected", "version": "3.1 and previous version"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "To resolve this issue and enhance security, during the S1 Agile application installation, we ensure \nonly privileged users can access various folders used by the S1 Agile application. This ensures \nthat S1 Agile files can not be edited or replaced by users without sufficient privileges on that \ncomputer. \n\n\nWe would like to assert that this attack, if successful, can give \u201cAdministrator\u201d privileges to the \nattacker on the computer, but the configured IEDs will not see any impact in their configuration or \nfunctionality. The RBAC (\u2018Role-Based Access Control\u2019) on the IED remains unimpacted. \n\n\n\n\n\nWe strongly recommend customers to upgrade to the latest software version available. \nSoftware version 3.1.1 is released for customer usage in January 2025.", "supportingMedia": [{"type": "text/html", "value": "To resolve this issue and enhance security, during the S1 Agile application installation, we ensure \nonly privileged users can access various folders used by the S1 Agile application. This ensures \nthat S1 Agile files can not be edited or replaced by users without sufficient privileges on that \ncomputer. <br><br>\nWe would like to assert that this attack, if successful, can give \u201cAdministrator\u201d privileges to the \nattacker on the computer, but the configured IEDs will not see any impact in their configuration or \nfunctionality. The RBAC (\u2018Role-Based Access Control\u2019) on the IED remains unimpacted. \n\n<br><br>\n\nWe strongly recommend customers to upgrade to the latest software version available. \nSoftware version 3.1.1 is released for customer usage in January 2025. \n\n<br>", "base64": false}]}], "references": [{"url": "https://www.gevernova.com/grid-solutions/sites/default/files/resources/products/support/ges-2025-001.pdf"}], "workarounds": [{"lang": "en", "value": "As a workaround, GE Vernova recommends having sufficient security controls in place on the \nworkstation where S1 Agile software is installed. This will ensure the attacker\u2019s remote \nconnection to the computer is not feasible. Harden the computer on which S1 Agile is installed. \nThe product deployment guide can be used to understand the guidelines around how the product \ncan be deployed in the end user\u2019s environment.", "supportingMedia": [{"type": "text/html", "value": "As a workaround, GE Vernova recommends having sufficient security controls in place on the \nworkstation where S1 Agile software is installed. This will ensure the attacker\u2019s remote \nconnection to the computer is not feasible. Harden the computer on which S1 Agile is installed. \nThe product deployment guide can be used to understand the guidelines around how the product \ncan be deployed in the end user\u2019s environment. \n\n<br>", "base64": false}]}], "x_generator": {"engine": "cveClient/1.0.15"}, "descriptions": [{"lang": "en", "value": "Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "2cf0fb33-79e2-44e0-beb8-826cc5ce3250", "shortName": "GE_Vernova", "dateUpdated": "2025-09-24T13:31:23.806Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9038", "state": "PUBLISHED", "dateUpdated": "2025-09-24T13:31:23.806Z", "dateReserved": "2025-08-14T13:30:30.722Z", "assignerOrgId": "2cf0fb33-79e2-44e0-beb8-826cc5ce3250", "datePublished": "2025-09-22T14:49:38.805Z", "assignerShortName": "GE_Vernova"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "S1 Agile Configuration Software", "vendor": "GE Vernova", "versions": [{"status": "affected", "version": "3.1 and previous version"}]}], "source": "GEPowerCVD@ge.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version."}], "id": "CVE-2025-9038", "lastModified": "2026-06-17T10:08:12.180", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "GEPowerCVD@ge.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9038", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-22T16:54:16.367027Z", "version": "2.0.3"}}]}, "published": "2025-09-22T15:15:40.423", "references": [{"source": "GEPowerCVD@ge.com", "url": "https://www.gevernova.com/grid-solutions/sites/default/files/resources/products/support/ges-2025-001.pdf"}], "sourceIdentifier": "GEPowerCVD@ge.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "GEPowerCVD@ge.com", "type": "Secondary"}]}

{}

{}