Controller 6000 and Controller 7000 vulnerabilities

Product

Controller 6000 and Controller 7000

by Gallagher · last CVE Dec 12, 2024

CVEs

On KEV

6.8

Max CVSS

New 30D

Vulnerabilities7 In the news0 Timeline

Severity mix

Critical 0High 0Medium 7Low 0

Severity

All severities7 Critical0 High0 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Controller 6000 and Controller 7000 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-22387	6.8	0%	Jul 11	External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections… Affected: through 8.60; 9.10 before vCR9.10.240520a; 9.00 before vCR9.00.240521a; 8.90 before vCR8.90.240520a; 8.80 before vCR8.80.240520a; 8.70 before vCR8.70.240520a
CVE-2024-24972	6.5	0%	Sep 11	Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot… Affected: through 8.70; 9.10 before vCR9.10.240816a; 9.00 before vCR9.00.240816a; 8.90 before vCR8.90.240816a; 8.80 before vCR8.80.240816b
CVE-2024-23317	6.3	0%	Jul 11	External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code… Affected: before 8.60; 9.10 through vCR9.10.240520a; 9.00 through vCR9.00.240521a; 8.90 through vCR8.90.240520a; 8.80 through vCR8.80.240520a; 8.70 through vCR8.70.240520a
CVE-2024-23906	6.1	0%	Sep 11	Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify Controller… Affected: through 8.70; 9.10 before vCR9.10.240816a; 9.00 before vCR9.00.240816a; 8.90 before vCR8.90.240816a; 8.80 before vCR8.80.240816b
CVE-2024-41146	4.6	0%	Dec 12	Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access to HBUS… Affected: through 8.80; 9.10 before vCR9.10.241108a; 9.00 before vCR9.00.241108a; 8.90 before vCR8.90.241107a
CVE-2024-39808	4.6	0%	Sep 11	Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Controller wiring to… Affected: through 8.70; 9.10 before vCR9.10.240816a; 9.00 before vCR9.00.240816a; 8.90 before vCR8.90.240816a; 8.80 before vCR8.80.240816b
CVE-2024-23485	4.6	0%	Jul 11	Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to secured door locks… Affected: 9.10 before vCR9.10.240520a; 9.00 before vCR9.00.240521a; 8.90 before vCR8.90.240520a; 8.80 before vCR8.80.240520a; 8.70 before vCR8.70.240520a; through 8.60