Cyber Resilience

CVE-2024-22387

Medium

Published: 11 July 2024

Published
11 July 2024
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
EPSS Score 0.0012 30.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22387 is a medium-severity External Control of Critical State Data (CWE-642) vulnerability in Gallagher Technical (inferred from references). Its CVSS base score is 6.8 (Medium).

Operationally, ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpected behavior that in some circumstances could compromise site physical security controls.…

more

Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes. This issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.

CWE(s)
CWE-642

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Gallagher
Technical
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CM-3 Configuration Change Control
addresses: CWE-642

Monitors, approves, and documents changes to critical configuration state data, mitigating external control risks.

IA-4 Identifier Management
addresses: CWE-642

Requires authorization and prevents reuse, mitigating external control of critical identifier state data.

SI-22 Information Diversity
addresses: CWE-642

Directly counters external corruption or unavailability of critical state data by mandating and using alternative sources for essential functions.

SI-9 Information Input Restrictions
addresses: CWE-642

Limits external actors' ability to control critical state through input channels.

References