CVE-2024-22383

Severity: medium (CVSS 6.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-05 · updated 2026-06-17
Weakness: CWE-772

Description

Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service. This issue affects: All variants of the Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507(MR1)), 8.90 prior to vCR8.90.240209b (distributed in 8.90.1751 (MR3)), 8.80 prior to vCR8.80.240209a (distributed in 8.80.1526 (MR4)), 8.70 prior to vCR8.70.240209a (distributed in 8.70.2526 (MR6)).

Affected products

Gallagher Controller 7000: from 9.00 before vCR9.00.231204b; from 8.90 before vCR8.90.240209b; from 8.80 before vCR8.80.240209a; from 8.70 before vCR8.70.240209a — fixed in vCR8.70.240209a, vCR8.80.240209a, vCR8.90.240209b, vCR9.00.231204b

How to fix

Upgrade to a fixed version: Gallagher Controller 7000 vCR8.70.240209a, vCR8.80.240209a, vCR8.90.240209b, vCR9.00.231204b. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-22383 or the next vulnerability affects your stack