CVE-2023-22439

low-risk
Published 2023-12-18

Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.1/10 Low
NETWORK / HIGH complexity

Affected Products (2)

Controller 6000 Firmware

Affected Vendors

Gallagher

References (2)

Vendor Advisory https://security.gallagher.com/Security-Advisories/CVE-2023-22439
Vendor Advisory https://security.gallagher.com/Security-Advisories/CVE-2023-22439
18
/ 100
low-risk
Severity 11/34 · Low
Exploitability 0/34 · Minimal
Exposure 7/34 · Low