Lucene search

[email protected]NVD:CVE-2023-24584

HistoryJun 01, 2023 - 5:15 a.m.

CVE-2023-24584

2023-06-0105:15:09

CWE-120

[email protected]

web.nvd.nist.gov

cve-2023-24584

buffer overflow

controller 6000

web interface

upload feature

security vulnerability

vcr8.80.230201a

vcr8.70.230201a

vcr8.60.230201b

vcr8.50.230201a

vcr8.40

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

56.9%

JSON

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature.

This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

Affected configurations

Nvd

Node

gallaghercontroller_6000Match-

AND

gallaghercontroller_6000_firmwareRange<8.50.230201a

gallaghercontroller_6000_firmwareRange8.60–8.60.230201b

gallaghercontroller_6000_firmwareRange8.70–8.70.230201a

gallaghercontroller_6000_firmwareRange8.80–8.80.230201a

VendorProductVersionCPE
gallaghercontroller_6000-cpe:2.3:h:gallagher:controller_6000:-:*:*:*:*:*:*:*
gallaghercontroller_6000_firmware*cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
gallagher	controller_6000	-	cpe:2.3:h:gallagher:controller_6000:-:::::::*
gallagher	controller_6000_firmware	*	cpe:2.3:o:gallagher:controller_6000_firmware::::::::

References

security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.002

Percentile

56.9%

JSON

Related for NVD:CVE-2023-24584

prion1 cvelist1 cve1