CVE-2024-23317 Path traversal in Controller 6000 and Controller 7000
Local attackers can execute arbitrary code on Gallagher Controller 6000/7000 devices via external control of file names or paths.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-23317?
CVE-2024-23317 is a medium-severity path traversal vulnerability in Gallagher Controller 6000 and Controller 7000, published on 11 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution.
This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
Weakness: CWE-73
Which versions are affected by CVE-2024-23317?
How do I fix CVE-2024-23317?
No fix has been published for CVE-2024-23317 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-23317 being exploited?
There is no known exploitation of CVE-2024-23317 in the wild and no public exploit code.
Sources
Also known as GHSA-fc2g-vx9q-c76v.