CVE-2023-24584: Gallagher Controller 6000 Firmware

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior.

Affected products

• Gallagher Controller 6000 Firmware: before 8.50.230201a (fixed in 8.50.230201a); from 8.60, before 8.60.230201b (fixed in 8.60.230201b); from 8.70, before 8.70.230201a (fixed in 8.70.230201a); from 8.80, before 8.80.230201a (fixed in 8.80.230201a)

Published 2023-06-01. Last modified 2026-06-17.