Gallagher Controller 6000 vulnerabilities

Latest Gallagher Controller 6000 CVEs

Newest publication first

1. CVE-2023-41967 Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical acc...

   Published 2023-12-18

   Medium·CVSS 4.6 EPSS 0.31%

   Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages...

2. CVE-2023-24590 A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service.....

   Published 2023-12-18

   High·CVSS 8.8 EPSS 0.61%

   A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service. This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (dis...

3. CVE-2023-24584 Controller 6000 buffer overflow via upload feature in web interface

   Published 2023-06-01

   Critical·CVSS 9.8 EPSS 0.50%

   Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.