CVE-2022-26078 : Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP ad

Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address. This issue affects: Gallagher Gallagher Controller 6000 vCR8.60 versions prior to 220303a; vCR8.50 versions prior to 220303a; vCR8.40 versions prior to 220303a; vCR8.30 versions prior to 220303a.

Published 2022-07-06 17:15:08

Updated 2022-07-14 12:42:12

Source Gallagher Group Ltd.

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2022-26078

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-26078

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Gallagher Group Ltd.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-26078

CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Assigned by: disclosures@gallagher.com (Secondary)

Products affected by CVE-2022-26078

Gallagher » Controller 6000 Firmware
Versions from including (>=) 8.60 and before (<) 8.60.220303a
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Gallagher » Controller 6000 » Version: N/A
Gallagher » Controller 6000 Firmware
Versions from including (>=) 8.40 and before (<) 8.40.220303a
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Gallagher » Controller 6000 » Version: N/A
Gallagher » Controller 6000 Firmware
Versions from including (>=) 8.50 and before (<) 8.50.220303a
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Gallagher » Controller 6000 » Version: N/A
Gallagher » Controller 6000 Firmware
Versions from including (>=) 8.30 and before (<) 8.30.220303a
cpe:2.3:o:gallagher:controller_6000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Gallagher » Controller 6000 » Version: N/A

Vulnerability Details : CVE-2022-26078

Exploit prediction scoring system (EPSS) score for CVE-2022-26078

CVSS scores for CVE-2022-26078

CWE ids for CVE-2022-26078

References for CVE-2022-26078

Products affected by CVE-2022-26078