CVE-2023-24584

Summary

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature.

This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

Affected Software

Weaknesses

• CWE-120: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Workarounds

Ensure dipswitch 1 is turned off on all Controllers and the option, "Dipswitch 1 controls the diagnostic web interface", is not checked in Configuration Client on Controller property pages. Do not use the Controller override, "Enable WWW Connections". Refer to the Gallagher Command Centre Hardening Guide for more details.

ADP Enrichment

CVE Program Container

Additional References

• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584

• ←Previous
• Next→