A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service. This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.
Published 2023-12-18 22:15:09
Updated 2024-01-05 18:33:27
View at NVD,   CVE.org
Vulnerability category: OverflowDenial of service

Products affected by CVE-2023-24590

Exploit prediction scoring system (EPSS) score for CVE-2023-24590

0.17%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-24590

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
1.6
5.9
Gallagher Group Ltd.
8.8
HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2.8
5.9
NIST 2024-01-05

CWE ids for CVE-2023-24590

  • The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
    Assigned by:
    • disclosures@gallagher.com (Secondary)
    • nvd@nist.gov (Primary)

References for CVE-2023-24590

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!