Medium severity · published Dec 18, 2023
CVE-2023-22439
Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service…
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface.
This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C6
Controller 6000/ Controller 7000 · Gallagher
through 8.50; 8.90 before vCR8.90.231204a; 8.80 before vCR8.80.231204a; 8.70 before vCR8.70.231204a; 8.60 before vCR8.60.231116a · source: vendor
CC
Command Centre · Gallagher
through 8.50; 8.60 before 8.60.231116a; 8.70 before 8.70.231204a; 8.80 before 8.80.231204a; 8.90 before 8.90.231204a · source: NVD
C6
Controller 6000 Firmware · Gallagher
through 8.50; 8.60 before 8.60.231116a; 8.70 before 8.70.231204a; 8.80 before 8.80.231204a; 8.90 before 8.90.231204a · source: NVD
Affected product
C6
Controller 6000/ Controller 7000
Gallagher