PT-2024-19378 · Gallagher · Gallagher Controller 7000

Published 2024-03-04 · Updated 2024-03-05 · CVE-2024-22383

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Gallagher Controller 7000 versions 8.70 prior to vCR8.70.240209a Gallagher Controller 7000 versions 8.80 prior to vCR8.80.240209a Gallagher Controller 7000 versions 8.90 prior to vCR8.90.240209b Gallagher Controller 7000 versions 9.00 prior to vCR9.00.231204b

Description The issue is related to a missing release of resource after effective lifetime, resulting in HBUS connected T-Series readers not automatically recovering after coming under attack over the RS-485 interface. This leads to a persistent denial of service.

Recommendations For Gallagher Controller 7000 version 8.70 prior to vCR8.70.240209a, update to vCR8.70.240209a or later. For Gallagher Controller 7000 version 8.80 prior to vCR8.80.240209a, update to vCR8.80.240209a or later. For Gallagher Controller 7000 version 8.90 prior to vCR8.90.240209b, update to vCR8.90.240209b or later. For Gallagher Controller 7000 version 9.00 prior to vCR9.00.231204b, update to vCR9.00.231204b or later.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2024-22383

Affected Products

Gallagher Controller 7000

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-22383 · Security Note
• https://twitter.com/CVEnew/status/1764857796221161716 · Twitter Post
• https://t.me/cvenotify/72975 · Telegram Post
• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-22383 · Note
• https://twitter.com/VulmonFeeds/status/1764904795444261077 · Twitter Post