admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-11-28 18:48:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2024/CVE-2024-22387.md
0xMarcio cb00e1339f Update CVE list 2025-09-29 21:09
2025-09-29 21:09:30 +02:00

23 lines
1.8 KiB
Markdown
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

### [CVE-2024-22387](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22387)
![](https://img.shields.io/static/v1?label=Product&message=Controller%206000%20and%20Controller%207000&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.70%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.80%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.90%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.00%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=9.10%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-642%20External%20Control%20of%20Critical%20State%20Data&color=brightgreen)
### Description
External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpected behavior that in some circumstances could compromise site physical security controls. Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes.This issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
### POC
#### Reference
No PoCs from references.
#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds
Reference in New Issue View Git Blame Copy Permalink