PT-2023-28197 · Gallagher · Gallagher Controller 6000

Published 2023-12-18 · Updated 2024-01-05 · CVE-2023-41967

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gallagher Controller 6000 versions 8.60 or earlier Gallagher Controller 6000 versions 8.70 prior to vCR8.70.231204a

Description Sensitive information is not properly cleared after a debug or power state transition in the Controller 6000. This could be exploited by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller, allowing them to view the configuration through the diagnostic web pages.

Recommendations For versions 8.60 or earlier, update to a version later than vCR8.70.231204a. For versions 8.70 prior to vCR8.70.231204a, update to vCR8.70.231204a or later, which is distributed in 8.70.2375 (MR5).

Fix

Weakness Enumeration

CWE-1272

CWE-212

Related Identifiers

CVE-2023-41967

Affected Products

Gallagher Controller 6000

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-41967 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41967 · Vendor Advisory
• https://security.gallagher.com/Security-Advisories/CVE-2023-41967 · Vendor Advisory
• https://t.me/cvenotify/64035 · Telegram Post
• https://t.me/cvenotify/66415 · Telegram Post
• https://twitter.com/CVEnew/status/1736872681440731516 · Twitter Post
• https://t.me/cvenotify/64131 · Telegram Post