CVE-2023-41967 LOW

CVE-2023-41967

Vendor Gallagher
Product Controller 6000
Weakness CWE-1272
Published December 18, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

2.4/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages. This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier.

Key dates

02Disclosure timeline

December 18, 2023 CVE published
August 2, 2024 Record updated