« Volver al listado

CVE-2024-39808

Estado: AplazadaMedia (4.6)—

Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Controller wiring to instigate a reboot leading to a denial of service.

This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Salto — Controller 6000AISalto — Controller 7000AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39808",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39808",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-11T13:36:21.512949Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosures@gallagher.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.6,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "disclosures@gallagher.com",
      "affectedData": [
        {
          "vendor": "Gallagher",
          "product": "Controller 6000 and Controller 7000",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "8.70"
            },
            {
              "status": "affected",
              "version": "9.10",
              "lessThan": "vCR9.10.240816a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.00",
              "lessThan": "vCR9.00.240816a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.90",
              "lessThan": "vCR8.90.240816a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.80",
              "lessThan": "vCR8.80.240816b",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-09-11T04:15:05.597",
  "references": [
    {
      "url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-39808",
      "source": "disclosures@gallagher.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosures@gallagher.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-131"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Controller wiring to instigate a reboot leading to a denial of service. \n\n\n\nThis issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior."
    },
    {
      "lang": "es",
      "value": "Cálculo incorrecto del tamaño del búfer (CWE-131) en el manejo de mensajes OSDP del Controller 6000 y del Controller 7000, permite que un atacante con acceso físico al cableado del Controller inicie un reinicio que conduzca a una denegación de servicio. Este problema afecta a: Controller 6000 y Controller 7000 9.10 anterior a vCR9.10.240816a (distribuido en 9.10.1530 (MR2)), 9.00 anterior a vCR9.00.240816a (distribuido en 9.00.2168 (MR4)), 8.90 anterior a vCR8.90.240816a (distribuido en 8.90.2155 (MR5)), 8.80 anterior a vCR8.80.240816b (distribuido en 8.80.1938 (MR6)), todas las versiones de 8.70 y anteriores."
    }
  ],
  "lastModified": "2026-06-17T07:42:50.647",
  "sourceIdentifier": "disclosures@gallagher.com"
}