External Control Vulnerability in Gallagher Controller 6000 and 7000 Products

CVE-2024-22387

Summary

A security vulnerability has been identified in Gallagher's Controller 6000 and 7000 diagnostic web interface, which is susceptible to external control of critical state data (CWE-642). This weakness allows authenticated users to modify input/output connections of the device, potentially resulting in uncontrolled system behavior that could jeopardize physical site security measures. Gallagher recommends that the diagnostic web page, which is disabled by default, should only be enabled under the guidance of Gallagher technical support to prevent unauthorized access and manipulation of sensitive equipment.

References