What is CVE-2023-6355?

CVE-2023-6355 is a medium-severity vulnerability in Gallagher Controller 7000, classified under CWE-1253. CVSS score: 6.8/10. Published 2023-12-18.

How severe is CVE-2023-6355?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Auth bypass in Gallagher Controller 7000

CVE-2023-6355

Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (MR1)), 8.90 prior to vCR8.90.231204a (distributed in 8.90.1620 (MR2)), 8.80 prior to vCR8.80.231204a (distributed in 8.80.1369 (MR3)), 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)).

EPSS: 0.004 (27.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Gallagher Controller 7000 — versions 9.00, 8.90, 8.80
Gallagher Controller_7000
Gallagher Controller_7000_firmware

Weakness classification (CWE)

References

disclosures@gallagher.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-6355?: CVE-2023-6355 is a medium-severity vulnerability in Gallagher Controller 7000, classified under CWE-1253. CVSS score: 6.8/10. Published 2023-12-18.
How severe is CVE-2023-6355?: Medium severity. CVSS v3 base score is 6.8 out of 10.