Log in Start free

Vulnerability · Published Mar 5, 2024 · Assigned by Gallagher

CVE-2024-22383

Medium 6.2

In plain English

A medium-severity security flaw in Controller 7000 from Gallagher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.2%top 93.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service. This issue affects: All variants of the Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507(MR1)), 8.90 prior to vCR8.90.240209b (distributed in 8.90.1751 (MR3)), 8.80 prior to vCR8.80.240209a (distributed in 8.80.1526 (MR4)), 8.70 prior to vCR8.70.240209a (distributed in 8.70.2526 (MR6)).

Affected products (as reported)

VendorProductVersions
Gallagher Controller 7000 9.00 – before vCR9.00.231204b8.90 – before vCR8.90.240209b8.80 – before vCR8.80.240209a8.70 – before vCR8.70.240209a

Weakness: CWE-772 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References