CVE-2023-24590
Quick assessment
Affected
Gallagher Controller 6000
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gallagher Controller 6000是新西兰Gallagher公司的一个 Gallagher 命令中心服务器和分布式现场硬件之间的接口。 Gallagher Controller 6000 vCR8.60.231116a 之前版本、8.50 及之前版本存在格式化字符串错误漏洞，该漏洞源于diagnostic Web 界面中的格式字符串问题可用于从内存中写入或读取，在某些情况下会使 Controller 6000 崩溃，从而导致拒绝服务。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-24590
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service.
This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部控制的格式字符串
Source: CVE Program / CVE List V5
Vulnerability Title
Gallagher Controller 6000 格式化字符串错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gallagher Controller 6000是新西兰Gallagher公司的一个 Gallagher 命令中心服务器和分布式现场硬件之间的接口。 Gallagher Controller 6000 vCR8.60.231116a 之前版本、8.50 及之前版本存在格式化字符串错误漏洞，该漏洞源于diagnostic Web 界面中的格式字符串问题可用于从内存中写入或读取，在某些情况下会使 Controller 6000 崩溃，从而导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Gallagher | Controller 6000 | 0 ~ 8.50 | - |
|
II. Public POCs for CVE-2023-24590
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-24590
请登录查看更多情报信息。
Other References for CVE-2023-24590 (1)
Same Patch Batch · Gallagher · 2023-12-18 · 8 CVEs total
| CVE-2023-6355 | 6.8 MEDIUM | Gallagher Controller 7000 安全漏洞 |
| CVE-2023-46686 | 5.5 MEDIUM | Gallagher Command Centre 安全漏洞 |
| CVE-2023-23570 | 5.4 MEDIUM | Gallagher Command Centre 安全漏洞 |
| CVE-2023-23576 | 4.3 MEDIUM | Gallagher Command Centre 安全漏洞 |
| CVE-2023-23584 | 4.3 MEDIUM | Gallagher Command Centre 安全漏洞 |
| CVE-2023-22439 | 3.1 LOW | Gallagher Controller 6000 输入验证错误漏洞 |
| CVE-2023-41967 | 2.4 LOW | Gallagher Controller 6000 安全漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-134
-
CVE-2026-14157
华硕路由器受控格式字符串致远程命令执行漏洞 -
CVE-2026-47494
NVIDIA Linux驱动格式字符串漏洞致代码执行 -
CVE-2026-84691
Automation-controller: automation-controller-container: auto -
CVE-2026-18461
Use of Externally-Controlled Format String vulnerability in -
CVE-2026-69395
Active Directory Certificate Services (AD CS) Information Di
V. Comments for CVE-2023-24590
No comments yet