Medium severity · published Mar 5, 2024
CVE-2024-22383
Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under…
6.2
CVSS
0.2%
EPSS
No
On KEV
Description
Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service.
This issue affects: All variants of the Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507(MR1)), 8.90 prior to vCR8.90.240209b (distributed in 8.90.1751 (MR3)), 8.80 prior to vCR8.80.240209a (distributed in 8.80.1526 (MR4)), 8.70 prior to vCR8.70.240209a (distributed in 8.70.2526 (MR6)).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C7
Controller 7000 · Gallagher
9.00 before vCR9.00.231204b; 8.90 before vCR8.90.240209b; 8.80 before vCR8.80.240209a; 8.70 before vCR8.70.240209a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22383
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22383
security.gallagher.com
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-22383
More from Controller 7000
6.8
CVE-2023-6355
Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug
6.5
CVE-2025-35983
Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform…