« Volver al listado

CVE-2024-23485

Estado: AplazadaMedia (4.6)—

Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access.

This issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)),  8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gallagher — Aperio Communication HUBAIGallagher — Controller 6000AIGallagher — Controller 7000AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-23485",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23485",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-11T13:52:19.796635Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosures@gallagher.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.6,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "disclosures@gallagher.com",
      "affectedData": [
        {
          "vendor": "Gallagher",
          "product": "Controller 6000 and Controller 7000",
          "versions": [
            {
              "status": "affected",
              "version": "9.10",
              "lessThan": "vCR9.10.240520a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.00",
              "lessThan": "vCR9.00.240521a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.90",
              "lessThan": "vCR8.90.240520a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.80",
              "lessThan": "vCR8.80.240520a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.70",
              "lessThan": "vCR8.70.240520a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "8.60"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-07-11T03:15:03.327",
  "references": [
    {
      "url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23485",
      "source": "disclosures@gallagher.com"
    },
    {
      "url": "https://security.gallagher.com/Security-Advisories/CVE-2024-23485",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosures@gallagher.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1304"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access. \n\nThis issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)),  8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior."
    },
    {
      "lang": "es",
      "value": "La integridad preservada inadecuadamente del estado de configuración del hardware durante una operación de ahorro/restauración de energía (CWE-1304) en el controlador 6000 y 7000 puede provocar que puertas cerradas seguras conectadas a través de concentradores de comunicación Aperio permitan momentáneamente el libre acceso. Este problema afecta a: Gallagher Controller 6000 y 7000 9.10 antes de vCR9.10.240520a (distribuido en 9.10.1268(MR1)), 9.00 antes de vCR9.00.240521a (distribuido en 9.00.1990(MR3)), 8.90 antes de vCR8. 90.240520a (distribuido en 8.90.1947 (MR4)), 8.80 antes de vCR8.80.240520a (distribuido en 8.80.1726 (MR5)), 8.70 antes de vCR8.70.240520a (distribuido en 8.70.2824 (MR7)), todos Versiones de 8.60 y anteriores."
    }
  ],
  "lastModified": "2026-06-17T07:13:02.563",
  "sourceIdentifier": "disclosures@gallagher.com"
}