PT-2024-19893 · Gallagher · Gallagher Controller 7000+1

Published 2024-07-11 · Updated 2024-07-11 · CVE-2024-23485

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gallagher Controller 6000 and 7000 versions 8.60 and prior Gallagher Controller 6000 and 7000 versions 8.70 prior to vCR8.70.240520a Gallagher Controller 6000 and 7000 versions 8.80 prior to vCR8.80.240520a Gallagher Controller 6000 and 7000 versions 8.90 prior to vCR8.90.240520a Gallagher Controller 6000 and 7000 versions 9.00 prior to vCR9.00.240521a Gallagher Controller 6000 and 7000 versions 9.10 prior to vCR9.10.240520a

Description The issue is related to improperly preserved integrity of hardware configuration state during a power save/restore operation, which can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access.

Recommendations For versions 8.60 and prior, update to a version later than vCR8.60. For versions 8.70, update to vCR8.70.240520a or later. For versions 8.80, update to vCR8.80.240520a or later. For versions 8.90, update to vCR8.90.240520a or later. For versions 9.00, update to vCR9.00.240521a or later. For versions 9.10, update to vCR9.10.240520a or later.

Fix

Weakness Enumeration

CWE-1304

Related Identifiers

CVE-2024-23485

Affected Products

Gallagher Controller 6000

Gallagher Controller 7000

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-23485 · Security Note
• https://t.me/cvedetector/625 · Telegram Post
• https://t.me/cvenotify/85762 · Telegram Post
• https://security.gallagher.com/Security-Advisories/CVE-2024-23485 · Note
• https://twitter.com/CVEnew/status/1811322664793014755 · Twitter Post