by Kastro
Paper/Archive/CVE-2023-24584

CVE-2023-24584

Gallagher Controller 6000 — Controller 6000 buffer overflow via upload feature in web interface

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.6.426 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

Affected

ProductAffectedFixed inSource
Controller 6000< vCR8.80.230201avCR8.80.230201aCNA
Controller 6000< vCR8.70.230201avCR8.70.230201aCNA
Controller 6000< vCR8.60.230201bvCR8.60.230201bCNA
Controller 6000< vCR8.50.230201avCR8.50.230201aCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Gallagher (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsecurity.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584