CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2023-41967
https://notcve.org/view.php?id=CVE-2023-41967
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages. This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier. Un atacante con conocimiento de la contraseña de diagnóstico predeterminada de Controller 6000 y acceso físico al Controlador para ver su configuración a través de las páginas web de diagnóstico podría abusar de la información confidencial no borrada después de la transición del estado de depuración/encendido en el Controlador. Este problema afecta a: Gallagher Controller 6000 8.70 anterior a vCR8.70.231204a (distribuido en 8.70.2375 (MR5)), v8.60 o anterior. • https://security.gallagher.com/Security-Advisories/CVE-2023-41967 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-24590
https://notcve.org/view.php?id=CVE-2023-24590
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service. This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior. Un problema de cadena de formato en la interfaz web de diagnóstico opcional del Controller 6000 se puede utilizar para escribir/leer desde la memoria y, en algunos casos, bloquear el Controller 6000, lo que provoca una denegación de servicio. Este problema afecta a: Gallagher Controller 6000 8.60 anterior a vCR8.60.231116a (distribuido en 8.60.2550 (MR7)), todas las versiones 8.50 y anteriores. • https://security.gallagher.com/Security-Advisories/CVE-2023-24590 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2023-22439
https://notcve.org/view.php?id=CVE-2023-22439
Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior. Se puede utilizar una validación de entrada incorrecta de una solicitud HTTP grande en la interfaz web de diagnóstico opcional de Controller 6000 y Controller 7000 (puerto 80) para realizar una denegación de servicio de la interfaz web de diagnóstico. Este problema afecta a: Gallagher Controller 6000 y 7000 8.90 antes de vCR8.90.231204a (distribuido en 8.90.1620 (MR2)), 8.80 antes de vCR8.80.231204a (distribuido en 8.80.1369 (MR3)), 8.70 antes de vCR8. 70.231204a (distribuido en 8.70.2375 (MR5)), 8.60 antes de vCR8.60.231116a (distribuido en 8.60.2550 (MR7)), todas las versiones de 8.50 y anteriores. • https://security.gallagher.com/Security-Advisories/CVE-2023-22439 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-24584 – Controller 6000 buffer overflow via upload feature in web interface
https://notcve.org/view.php?id=CVE-2023-24584
Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior. • https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-26078
https://notcve.org/view.php?id=CVE-2022-26078
Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address. This issue affects: Gallagher Gallagher Controller 6000 vCR8.60 versions prior to 220303a; vCR8.50 versions prior to 220303a; vCR8.40 versions prior to 220303a; vCR8.30 versions prior to 220303a. El controlador Gallagher 6000 es vulnerable a un ataque de Denegación de Servicio por medio de paquetes ARP conflictivos con una dirección IP duplicada. Este problema afecta: Gallagher Controller 6000 versiones vCR8.60 anteriores a 220303a; versiones vCR8.50 anteriores a 220303a; versiones vCR8.40 anteriores a 220303a; versiones vCR8.30 anteriores a 220303a • https://security.gallagher.com/Security-Advisories/CVE-2022-26078 • CWE-754: Improper Check for Unusual or Exceptional Conditions •