Vulnerability · Published Jun 1, 2023 · Assigned by Gallagher
CVE-2023-24584Controller 6000 buffer overflow via upload feature in web interface
High 7.5
In plain English
A high-severity buffer overflow in Controller 6000 from Gallagher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gallagher | Controller 6000 | 0 – before vCR8.80.230201a0 – before vCR8.70.230201a0 – before vCR8.60.230201b0 – before vCR8.50.230201a |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H