CVE-2023-24584
📋 TL;DR
CVE-2023-24584 is a buffer overflow vulnerability in Gallagher Controller 6000's diagnostic web interface upload feature. Attackers can exploit this to execute arbitrary code or crash the controller. This affects all Controller 6000 devices running vulnerable firmware versions.
💻 Affected Systems
- Gallagher Controller 6000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, controller manipulation, or disabling of physical security systems.
Likely Case
Service disruption through denial of service (controller crash) or limited code execution within controller constraints.
If Mitigated
No impact if patched or if diagnostic interface is disabled/restricted.
🎯 Exploit Status
Buffer overflow exploitation requires crafting specific malicious uploads. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vCR8.80.230201a, vCR8.70.230201a, vCR8.60.230201b, vCR8.50.230201a or later
Vendor Advisory: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584
Restart Required: Yes
Instructions:
1. Download the appropriate firmware update from Gallagher. 2. Backup controller configuration. 3. Apply firmware update via Gallagher Command Centre. 4. Restart the controller. 5. Verify firmware version.
🔧 Temporary Workarounds
Disable diagnostic web interface
allDisable the diagnostic web interface upload feature if not required.
Configuration through Gallagher Command Centre: Disable diagnostic web interface or restrict upload functionality
Network segmentation
allRestrict network access to the controller's diagnostic interface using firewall rules.
Firewall rules to block external access to controller diagnostic port (typically HTTP/HTTPS)
🧯 If You Can't Patch
- Implement strict network segmentation to isolate controllers from untrusted networks
- Disable diagnostic web interface entirely if not required for operations
🔍 How to Verify
Check if Vulnerable:
Check firmware version via Gallagher Command Centre or controller web interface. Compare against affected versions list.Check Version:
Check via Gallagher Command Centre or controller web interface admin panelVerify Fix Applied:
Verify firmware version is vCR8.80.230201a, vCR8.70.230201a, vCR8.60.230201b, vCR8.50.230201a or later.📡 Detection & Monitoring
Log Indicators:
- Multiple failed upload attempts to diagnostic interface
- Unusual file uploads to controller diagnostic endpoint
- Controller crash/restart logs
Network Indicators:
- Unusual HTTP POST requests to controller diagnostic upload endpoints
- Traffic patterns suggesting buffer overflow attempts
SIEM Query:
source="controller_logs" AND (event="upload_failed" OR event="controller_restart")