CVE-2023-1552: ToolboxST Deserialization of Untrusted Configuration Data

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-11 · updated 2026-06-17
Weakness: CWE-502

Description

ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's context through the deserialization of an untrusted configuration file. Two CVSS scores have been provided to capture the differences between the two aforementioned attack vectors. Customers are advised to update to ToolboxST 7.10 which can be found in ControlST 7.10. If unable to update at this time customers should ensure they are following the guidance laid out in GE Gas Power's Secure Deployment Guide (GEH-6839). Customers should ensure they are not running ToolboxST as an Administrative user.

Affected products

GE Gas Power ToolboxST: before 7.10 — fixed in 7.10

How to fix

Upgrade to a fixed version: GE Gas Power ToolboxST 7.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-1552 or the next vulnerability affects your stack