PT-2023-18497 · Gallagher · Gallagher Controller 6000+1

Kevin Schaller + 1 · CVE-2023-22439 · Publicado 2023-12-18 · Atualizado 2023-12-28

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Gallagher Controller 6000 and 7000 versions 8.50 and prior Gallagher Controller 6000 and 7000 versions 8.60 through 8.60.231116a Gallagher Controller 6000 and 7000 versions 8.70 through 8.70.231204a Gallagher Controller 6000 and 7000 versions 8.80 through 8.80.231204a Gallagher Controller 6000 and 7000 versions 8.90 through 8.90.231204a

Description The issue is caused by improper input validation of a large HTTP request in the diagnostic web interface on Port 80, which can be used to perform a Denial of Service of the diagnostic web interface.

Recommendations For versions 8.50 and prior, update to a version later than 8.50. For versions 8.60 through 8.60.231116a, update to version 8.60.231116a or later. For versions 8.70 through 8.70.231204a, update to version 8.70.231204a or later. For versions 8.80 through 8.80.231204a, update to version 8.80.231204a or later. For versions 8.90 through 8.90.231204a, update to version 8.90.231204a or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-22439

Produtos afetados

Gallagher Controller 6000

Gallagher Controller 7000

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-22439 · Nota de Segurança
• https://twitter.com/CVEnew/status/1736872686910144604 · Publicação no Twitter
• https://t.me/cvenotify/64030 · Publicação no Telegram
• https://security.gallagher.com/Security-Advisories/CVE-2023-22439 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22439 · Aviso do Fabricante
• https://t.me/cvenotify/64126 · Publicação no Telegram