CVE-2023-24590 Other in Controller 6000
A format string vulnerability in the optional diagnostic web interface allows memory read/write and denial of service in Gallagher Controller 6000 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-24590?
CVE-2023-24590 is a high-severity vulnerability in Gallagher Controller 6000, published on 18 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service.
This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.
Weakness: CWE-134
Which versions are affected by CVE-2023-24590?
It affects 1 product.
Products include Gallagher Controller 6000 Firmware.
How do I fix CVE-2023-24590?
No fix has been published for CVE-2023-24590 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-24590 being exploited?
There is no known exploitation of CVE-2023-24590 in the wild and no public exploit code.
Other vulnerabilities in Gallagher Controller 6000
Sources
Also known as GHSA-273h-28gx-8f5j.