CVE-2023-24584: Controller 6000 buffer overflow via upload feature in web interface

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-01 · updated 2026-06-17
Weakness: CWE-120

Description

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

Affected products

Gallagher Controller 6000: before 8.50.230201a; from 8.60 before 8.60.230201b; from 8.70 before 8.70.230201a; from 8.80 before 8.80.230201a — fixed in 8.50.230201a, 8.60.230201b, 8.70.230201a, 8.80.230201a

How to fix

Upgrade to a fixed version: Gallagher Controller 6000 8.50.230201a, 8.60.230201b, 8.70.230201a, 8.80.230201a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24584 or the next vulnerability affects your stack