Search
Find a vulnerability
Search criteria
4 vulnerabilities found for controller_7000_firmware by gallagher
CVE-2024-23317 (GCVE-0-2024-23317)
Vulnerability from nvd – Published: 2024-07-11 02:39 – Updated: 2024-08-01 22:59
VLAI
EPSS
VEX
Summary
External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution.
This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-11 14:25 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gallagher | Controller 6000 and Controller 7000 |
Affected:
0 , < 8.60
(custom)
Affected: 9.10 , ≤ vCR9.10.240520a (custom) Affected: 9.00 , ≤ vCR9.00.240521a (custom) Affected: 8.90 , ≤ vCR8.90.240520a (custom) Affected: 8.80 , ≤ vCR8.80.240520a (custom) Affected: 8.70 , ≤ vCR8.70.240520a (custom) |
|
| gallagher | controller_6000_firmware |
Affected:
0 , ≤ 8.60
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:-:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
8.70 , < 8.70.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:8.70:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
8.80 , < 8.80.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:8.80:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
8.90 , < 8.90.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:8.90:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
9.00 , < 9.00.240521a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:9.00:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
9.10 , < 9.10.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:9.10:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
0 , ≤ 8.60
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:*:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
8.70 , < 8.70.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:8.70:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
8.80 , < 8.80.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:8.80:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
8.90 , < 8.90.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:8.90:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
9.00 , < 9.00.240521a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:9.00:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
9.10 , < 9.10.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:9.10:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThanOrEqual": "8.60",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:8.70:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.70.240520a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:8.80:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.80.240520a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:8.90:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.90.240520a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:9.00:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.00.240521a",
"status": "affected",
"version": "9.00",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:9.10:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.10.240520a",
"status": "affected",
"version": "9.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThanOrEqual": "8.60",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:8.70:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.70.240520a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:8.80:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.80.240520a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:8.90:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.90.240520a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:9.00:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.00.240521a",
"status": "affected",
"version": "9.00",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:9.10:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.10.240520a",
"status": "affected",
"version": "9.10",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23317",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-11T14:25:33.804644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-12T15:48:05.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:59:32.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23317"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Controller 6000 and Controller 7000",
"vendor": "Gallagher",
"versions": [
{
"lessThan": "8.60",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR9.10.240520a",
"status": "affected",
"version": "9.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR9.00.240521a",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR8.90.240520a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR8.80.240520a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR8.70.240520a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eExternal Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. \u003c/p\u003e\u003cp\u003e\u003cb\u003eThis issue affects:\u003c/b\u003e\u0026nbsp;9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e"
}
],
"value": "External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. \n\nThis issue affects:\u00a09.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-11T02:39:28.129Z",
"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"shortName": "Gallagher"
},
"references": [
{
"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23317"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"assignerShortName": "Gallagher",
"cveId": "CVE-2024-23317",
"datePublished": "2024-07-11T02:39:28.129Z",
"dateReserved": "2024-02-05T04:16:47.971Z",
"dateUpdated": "2024-08-01T22:59:32.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6355 (GCVE-0-2023-6355)
Vulnerability from nvd – Published: 2023-12-18 21:55 – Updated: 2024-08-02 08:28
VLAI
EPSS
VEX
Summary
Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug.
This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).
Severity
6.8 (Medium)
CWE
- CWE-1253 - Incorrect Selection of Fuse Values
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gallagher | Controller 7000 |
Affected:
9.00 , < vCR9.00.231204b
(custom)
Affected: 8.90 , < vCR8.90.231204a (custom) Affected: 8.80 , < vCR8.80.231204a (custom) Affected: 8.70 , < vCR8.70.231204a (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:28:21.793Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.gallagher.com/Security-Advisories/CVE-2023-6355"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Controller 7000",
"vendor": "Gallagher",
"versions": [
{
"lessThan": "vCR9.00.231204b",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "vCR8.90.231204a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
},
{
"lessThan": "vCR8.80.231204a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
},
{
"lessThan": "vCR8.70.231204a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIncorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. \u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue affects: Gallagher Controller 7000 \u003c/span\u003e9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)),\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).\u003c/span\u003e\n\n"
}
],
"value": "\nIncorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. \n\nThis issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)),\u00a08.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1253",
"description": "CWE-1253: Incorrect Selection of Fuse Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-18T21:55:58.148Z",
"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"shortName": "Gallagher"
},
"references": [
{
"url": "https://security.gallagher.com/Security-Advisories/CVE-2023-6355"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"assignerShortName": "Gallagher",
"cveId": "CVE-2023-6355",
"datePublished": "2023-12-18T21:55:58.148Z",
"dateReserved": "2023-11-28T03:08:23.484Z",
"dateUpdated": "2024-08-02T08:28:21.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-23317 (GCVE-0-2024-23317)
Vulnerability from cvelistv5 – Published: 2024-07-11 02:39 – Updated: 2024-08-01 22:59
VLAI
EPSS
VEX
Summary
External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution.
This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-11 14:25 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gallagher | Controller 6000 and Controller 7000 |
Affected:
0 , < 8.60
(custom)
Affected: 9.10 , ≤ vCR9.10.240520a (custom) Affected: 9.00 , ≤ vCR9.00.240521a (custom) Affected: 8.90 , ≤ vCR8.90.240520a (custom) Affected: 8.80 , ≤ vCR8.80.240520a (custom) Affected: 8.70 , ≤ vCR8.70.240520a (custom) |
|
| gallagher | controller_6000_firmware |
Affected:
0 , ≤ 8.60
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:-:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
8.70 , < 8.70.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:8.70:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
8.80 , < 8.80.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:8.80:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
8.90 , < 8.90.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:8.90:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
9.00 , < 9.00.240521a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:9.00:*:*:*:*:*:*:* |
|
| gallagher | controller_6000_firmware |
Affected:
9.10 , < 9.10.240520a
(custom)
cpe:2.3:o:gallagher:controller_6000_firmware:9.10:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
0 , ≤ 8.60
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:*:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
8.70 , < 8.70.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:8.70:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
8.80 , < 8.80.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:8.80:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
8.90 , < 8.90.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:8.90:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
9.00 , < 9.00.240521a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:9.00:*:*:*:*:*:*:* |
|
| gallagher | controller_7000_firmware |
Affected:
9.10 , < 9.10.240520a
(custom)
cpe:2.3:o:gallagher:controller_7000_firmware:9.10:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThanOrEqual": "8.60",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:8.70:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.70.240520a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:8.80:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.80.240520a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:8.90:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.90.240520a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:9.00:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.00.240521a",
"status": "affected",
"version": "9.00",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_6000_firmware:9.10:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_6000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.10.240520a",
"status": "affected",
"version": "9.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThanOrEqual": "8.60",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:8.70:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.70.240520a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:8.80:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.80.240520a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:8.90:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "8.90.240520a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:9.00:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.00.240521a",
"status": "affected",
"version": "9.00",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:gallagher:controller_7000_firmware:9.10:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "controller_7000_firmware",
"vendor": "gallagher",
"versions": [
{
"lessThan": "9.10.240520a",
"status": "affected",
"version": "9.10",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23317",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-11T14:25:33.804644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-12T15:48:05.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:59:32.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23317"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Controller 6000 and Controller 7000",
"vendor": "Gallagher",
"versions": [
{
"lessThan": "8.60",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR9.10.240520a",
"status": "affected",
"version": "9.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR9.00.240521a",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR8.90.240520a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR8.80.240520a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
},
{
"lessThanOrEqual": "vCR8.70.240520a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eExternal Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. \u003c/p\u003e\u003cp\u003e\u003cb\u003eThis issue affects:\u003c/b\u003e\u0026nbsp;9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e"
}
],
"value": "External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. \n\nThis issue affects:\u00a09.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-11T02:39:28.129Z",
"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"shortName": "Gallagher"
},
"references": [
{
"url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23317"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"assignerShortName": "Gallagher",
"cveId": "CVE-2024-23317",
"datePublished": "2024-07-11T02:39:28.129Z",
"dateReserved": "2024-02-05T04:16:47.971Z",
"dateUpdated": "2024-08-01T22:59:32.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6355 (GCVE-0-2023-6355)
Vulnerability from cvelistv5 – Published: 2023-12-18 21:55 – Updated: 2024-08-02 08:28
VLAI
EPSS
VEX
Summary
Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug.
This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).
Severity
6.8 (Medium)
CWE
- CWE-1253 - Incorrect Selection of Fuse Values
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Gallagher | Controller 7000 |
Affected:
9.00 , < vCR9.00.231204b
(custom)
Affected: 8.90 , < vCR8.90.231204a (custom) Affected: 8.80 , < vCR8.80.231204a (custom) Affected: 8.70 , < vCR8.70.231204a (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:28:21.793Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://security.gallagher.com/Security-Advisories/CVE-2023-6355"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Controller 7000",
"vendor": "Gallagher",
"versions": [
{
"lessThan": "vCR9.00.231204b",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "vCR8.90.231204a",
"status": "affected",
"version": "8.90",
"versionType": "custom"
},
{
"lessThan": "vCR8.80.231204a",
"status": "affected",
"version": "8.80",
"versionType": "custom"
},
{
"lessThan": "vCR8.70.231204a",
"status": "affected",
"version": "8.70",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIncorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. \u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue affects: Gallagher Controller 7000 \u003c/span\u003e9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)),\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).\u003c/span\u003e\n\n"
}
],
"value": "\nIncorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. \n\nThis issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)),\u00a08.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1253",
"description": "CWE-1253: Incorrect Selection of Fuse Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-18T21:55:58.148Z",
"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"shortName": "Gallagher"
},
"references": [
{
"url": "https://security.gallagher.com/Security-Advisories/CVE-2023-6355"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc",
"assignerShortName": "Gallagher",
"cveId": "CVE-2023-6355",
"datePublished": "2023-12-18T21:55:58.148Z",
"dateReserved": "2023-11-28T03:08:23.484Z",
"dateUpdated": "2024-08-02T08:28:21.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}