CVE-2024-22387
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:HSummary
CVE-2024-22387 is a medium-severity External Control of Critical State Data (CWE-642) vulnerability in Gallagher Technical (inferred from references). Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Access Token Manipulation (T1134); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19944
Vulnerability Data
External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpected behavior that in some circumstances could compromise site physical security controls.…
more
Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes. This issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 3 OS baselines
V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces access authorizations on the stored critical state data so unauthorized actors cannot read or modify it.
Limits which subjects may access the location holding security-critical state, reducing the set of actors that can tamper with it.
Requires cryptographic or other protection of information at rest, directly blocking unauthorized external access to critical state.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting integrity of data-at-rest stops external tampering with stored security-critical state.
Enforcing least-privilege access permissions directly prevents unauthorized actors from reaching critical state data.
Network-level controls reduce the attack surface that would otherwise allow external modification of state.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles discourage external control of security-critical state.
Information access restriction mechanisms enforce least-privilege access to critical state.
Access control policies directly limit who can read or modify security-critical state data.
Managing access rights prevents unauthorized actors from altering critical state stored externally.
Restricting privileged access rights reduces the chance that state data can be tampered with by unauthorized users.
Secure development practices can avoid placing critical state in externally writable locations.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-642
Oracle Linux 9 (2 rules)
- V-271811 OL 9 /etc/passwd- file must have mode 0644 or less permissive to prevent unauthorized access. prevents CWE-642
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-642
RHEL 7 (1 rule)
- V-204627 SNMP community strings on the Red Hat Enterprise Linux operating system must be changed from the default. prevents CWE-642