CVE-2023-41967

State: Published
Severity: 2.4 Low
Published: Dec 18, 2023
Updated: Aug 2, 2024
Reserved: Nov 1, 2023

Description

Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages.

This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier.

Scores

CVSS	Score	Vector	Source
3.1	2.4 Low	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Gallagher

Weaknesses

CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition

Affected Products

Product	Versions
Controller 6000Gallagher	8.60 and earlierAffected 8.70 to before vCR8.70.231204aAffected

References

https://security.gallagher.com/Security-Advisories/CVE-2023-41967

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.