CVE-2023-24590

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-18 · updated 2026-06-17
Weakness: CWE-134

Description

A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service. This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.

Affected products

Gallagher Controller 6000: through 8.50; from 8.60 before 8.60.231116a — fixed in 8.60.231116a

How to fix

Upgrade to a fixed version: Gallagher Controller 6000 8.60.231116a. Check the vendor advisory for mitigations.

References

https://security.gallagher.com/Security-Advisories/CVE-2023-24590
https://security.gallagher.com/Security-Advisories/CVE-2023-24590

Get alerted when CVE-2023-24590 or the next vulnerability affects your stack