PT-2023-18497 · Gallagher · Gallagher Controller 6000+1

Kevin Schaller + 1 · Published 2023-12-18 · Updated 2023-12-28 · CVE-2023-22439

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Gallagher Controller 6000 and 7000 versions 8.50 and prior Gallagher Controller 6000 and 7000 versions 8.60 through 8.60.231116a Gallagher Controller 6000 and 7000 versions 8.70 through 8.70.231204a Gallagher Controller 6000 and 7000 versions 8.80 through 8.80.231204a Gallagher Controller 6000 and 7000 versions 8.90 through 8.90.231204a

Description The issue is caused by improper input validation of a large HTTP request in the diagnostic web interface on Port 80, which can be used to perform a Denial of Service of the diagnostic web interface.

Recommendations For versions 8.50 and prior, update to a version later than 8.50. For versions 8.60 through 8.60.231116a, update to version 8.60.231116a or later. For versions 8.70 through 8.70.231204a, update to version 8.70.231204a or later. For versions 8.80 through 8.80.231204a, update to version 8.80.231204a or later. For versions 8.90 through 8.90.231204a, update to version 8.90.231204a or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-22439

Affected Products

Gallagher Controller 6000

Gallagher Controller 7000

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-22439 · Security Note
• https://security.gallagher.com/Security-Advisories/CVE-2023-22439 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22439 · Vendor Advisory
• https://twitter.com/CVEnew/status/1736872686910144604 · Twitter Post
• https://t.me/cvenotify/64030 · Telegram Post
• https://t.me/cvenotify/64126 · Telegram Post