PT-2024-29294 · Unknown · Controller 6000+1

Published 2024-12-12 · Updated 2024-12-12 · CVE-2024-41146

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Controller 6000 and Controller 7000 versions 8.80 and prior Controller 6000 and Controller 7000 versions 8.90 prior to vCR8.90.241107a Controller 6000 and Controller 7000 versions 9.00 prior to vCR9.00.241108a Controller 6000 and Controller 7000 versions 9.10 prior to vCR9.10.241108a

Description The issue allows an attacker with physical access to HBUS communication cabling to perform a Denial-of-Service attack against HBUS connected devices. This requires a device reboot to resolve.

Recommendations For versions 8.80 and prior, update to a version later than vCR8.90.241107a. For versions 8.90 prior to vCR8.90.241107a, update to vCR8.90.241107a or later. For versions 9.00 prior to vCR9.00.241108a, update to vCR9.00.241108a or later. For versions 9.10 prior to vCR9.10.241108a, update to vCR9.10.241108a or later.

Fix

Weakness Enumeration

CWE-694

Related Identifiers

CVE-2024-41146

Affected Products

Controller 6000

Controller 7000

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-41146 · Security Note
• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-41146 · Note
• https://twitter.com/CVEnew/status/1867171945080324218 · Twitter Post