LOW🇬🇧 English

CVE-2023-41967

CVSS 2.4v3.1pub. 2023-12-18upd. 2024-11-21

Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages. This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier.

oryginał EN
CVSS Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Gallagher Controller 6000

    HW
    Gallagher
    wszystkie wersje

  • Gallagher Controller 6000 Firmware

    OS
    Gallagher
    ≤ 8.608.70 – 8.70.231204a (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2023-24590HIGH7.5ten sam produkt

A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read ...

CVE-2023-24584HIGH7.5ten sam produkt

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature...

CVE-2022-26078HIGH7.5ten sam produkt

Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a dupli...

CVE-2023-22439LOW3.1ten sam produkt

Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnos...

CVE-2024-21815CRITICAL9.1PL ✓ten sam vendor

Gallagher Command Centre: niechronione dane uwierzytelniające integracji DVR