CVE-2024-23317

Description

External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.

Reserved 2024-02-05 | Published 2024-07-11 | Updated 2024-08-01 | Assigner Gallagher

Problem types

CWE-73 External Control of File Name or Path

Product status

Default status
affected

Any version before 8.60
affected

9.10
affected

9.00
affected

8.90
affected

8.80
affected

8.70
affected

References

security.gallagher.com/Security-Advisories/CVE-2024-23317

cve.org (CVE-2024-23317)

nvd.nist.gov (CVE-2024-23317)

Download JSON