Lucene search

[email protected]CVE-2023-24584

HistoryJun 01, 2023 - 5:15 a.m.

CVE-2023-24584

2023-06-0105:15:09

CWE-120

[email protected]

web.nvd.nist.gov

cve-2023-24584

controller 6000

buffer overflow

web interface

upload feature

vulnerability

nvd

security issue

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.4%

JSON

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature.

This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

Affected configurations

NVD

Node

gallaghercontroller_6000Match-

AND

gallaghercontroller_6000_firmwareRange<8.50.230201a

gallaghercontroller_6000_firmwareRange8.60–8.60.230201b

gallaghercontroller_6000_firmwareRange8.70–8.70.230201a

gallaghercontroller_6000_firmwareRange8.80–8.80.230201a

CPENameOperatorVersion
gallagher:controller_6000_firmwaregallagher controller 6000 firmwarelt8.50.230201a
gallagher:controller_6000_firmwaregallagher controller 6000 firmwarelt8.60.230201b
gallagher:controller_6000_firmwaregallagher controller 6000 firmwarelt8.70.230201a
gallagher:controller_6000_firmwaregallagher controller 6000 firmwarelt8.80.230201a

CPE	Name	Operator	Version
gallagher:controller_6000_firmware	gallagher controller 6000 firmware	lt	8.50.230201a
gallagher:controller_6000_firmware	gallagher controller 6000 firmware	lt	8.60.230201b
gallagher:controller_6000_firmware	gallagher controller 6000 firmware	lt	8.70.230201a
gallagher:controller_6000_firmware	gallagher controller 6000 firmware	lt	8.80.230201a

CNA Affected

[
  {
    "vendor": "Gallagher",
    "product": "Controller 6000",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "vCR8.80.230201a",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "vCR8.70.230201a",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "vCR8.60.230201b",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "vCR8.50.230201a",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.4%

JSON

Related for CVE-2023-24584

cvelist1 prion1 nvd1