What is CVE-2023-22439?

CVE-2023-22439 is a low-severity vulnerability in Gallagher Command Centre, classified under Improper Input Validation. CVSS score: 3.1/10. Published 2023-12-18.

How severe is CVE-2023-22439?

Low severity. CVSS v3 base score is 3.1 out of 10.

Improper input validation in Gallagher Command Centre

CVE-2023-22439

Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Controller 6000 and 7000 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.005 (40.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L.

Affected products

Gallagher Command_centre
Gallagher Controller_6000
Gallagher Controller 6000/ 7000 — versions 0, 8.90, 8.80
Gallagher Controller_6000_firmware
Gallagher Controller_7000

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

disclosures@gallagher.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-22439?: CVE-2023-22439 is a low-severity vulnerability in Gallagher Command Centre, classified under Improper Input Validation. CVSS score: 3.1/10. Published 2023-12-18.
How severe is CVE-2023-22439?: Low severity. CVSS v3 base score is 3.1 out of 10.