CVE-2023-41967
Low
Description
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages. This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier.
SeverityLow
CVSS2.4
Exploit probability—
ProductGallagher Controller 6000 Firmware
PublishedDec 18, 2023
First seenDec 18, 2023
Weakness typeCWE-1272CWE-1272
How to fix
Update
- gallagher controller_6000_firmware8.70.231204a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gallagher controller_6000_firmware | v ≤ 8.60, 8.70 ≤ v < 8.70.231204a | 8.70.231204a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.