PT-2023-30159 · Gallagher · Gallagher Command Centre Diagnostics Service

Published 2023-12-18 · Updated 2023-12-28 · CVE-2023-46686

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gallagher Diagnostics Service versions prior to 1.3.0

Description A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the configuration of the Diagnostics Service to prevent the use of less secure communication protocols.

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2023-46686

Affected Products

Gallagher Command Centre Diagnostics Service

References · 6

• https://security.gallagher.com/Security-Advisories/CVE-2023-46686 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46686 · Security Note
• https://t.me/cvenotify/64132 · Telegram Post
• https://twitter.com/CVEnew/status/1736872680555720998 · Twitter Post
• https://t.me/cvenotify/64036 · Telegram Post