CVE-2025-9038: S1 Agile Privilege Escalation
Published Sep 22, 2025
·Updated
Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version.
Affected Software
1 affected component
GE Vernova S1 Agile Configuration Software<3.1
Remediation
Information
To resolve this issue and enhance security, during the S1 Agile application installation, we ensure
only privileged users can access various folders used by the S1 Agile application. This ensures
that S1 Agile files can not be edited or replaced by users without sufficient privileges on that
computer.
We would like to assert that this attack, if successful, can give “Administrator” privileges to the
attacker on the computer, but the configured IEDs will not see any impact in their configuration or
functionality. The RBAC (‘Role-Based Access Control’) on the IED remains unimpacted.
We strongly recommend customers to upgrade to the latest software version available.
Software version 3.1.1 is released for customer usage in January 2025.
Event History
Sep 22, 2025
CVE Published
via MITRE·02:49 PM
Data Sourced
via MITRE·02:49 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
May 20, 57882
Event
via FIRST·01:58 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-9038?
CVE-2025-9038 has a high severity rating due to its potential for privilege escalation.
2
How do I fix CVE-2025-9038?
To fix CVE-2025-9038, upgrade your GE Vernova S1 Agile Configuration Software to version 3.2 or later.
3
What systems are affected by CVE-2025-9038?
CVE-2025-9038 affects GE Vernova S1 Agile Configuration Software versions 3.1 and earlier.
4
What type of vulnerability is CVE-2025-9038?
CVE-2025-9038 is classified as an Improper Privilege Management vulnerability.
5
Can CVE-2025-9038 lead to data breaches?
Yes, CVE-2025-9038 can potentially lead to data breaches through unauthorized privilege escalation.