CVEvulnerability

CVE-2023-22439

4.3 MEDIUM Published 2023-12-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.1 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-20

Description

Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.

Affected configurations

• gallagher controller 6000 firmware (<= 8.50) • gallagher controller 6000 firmware (>= 8.60 < 8.60.231116a) • gallagher controller 6000 firmware (>= 8.70 < 8.70.231204a) • gallagher controller 6000 firmware (>= 8.80 < 8.80.231204a) • gallagher controller 6000 firmware (>= 8.90 < 8.90.231204a) • gallagher command centre (<= 8.50) • gallagher command centre (>= 8.60 < 8.60.231116a) • gallagher command centre (>= 8.70 < 8.70.231204a) • gallagher command centre (>= 8.80 < 8.80.231204a) • gallagher command centre (>= 8.90 < 8.90.231204a)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References