CVE-2024-39808

Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Controller wiring to instigate a reboot leading to a denial of service. This issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-39808

Configurations

No configuration.

History

11 Sep 2024, 16:26

Type	Values Removed	Values Added
Summary		(es) Cálculo incorrecto del tamaño del búfer (CWE-131) en el manejo de mensajes OSDP del Controller 6000 y del Controller 7000, permite que un atacante con acceso físico al cableado del Controller inicie un reinicio que conduzca a una denegación de servicio. Este problema afecta a: Controller 6000 y Controller 7000 9.10 anterior a vCR9.10.240816a (distribuido en 9.10.1530 (MR2)), 9.00 anterior a vCR9.00.240816a (distribuido en 9.00.2168 (MR4)), 8.90 anterior a vCR8.90.240816a (distribuido en 8.90.2155 (MR5)), 8.80 anterior a vCR8.80.240816b (distribuido en 8.80.1938 (MR6)), todas las versiones de 8.70 y anteriores.

11 Sep 2024, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-11 04:15

Updated : 2024-09-11 16:26

NVD link : CVE-2024-39808

Mitre link : CVE-2024-39808

CVE.ORG link : CVE-2024-39808

JSON object : View

Products Affected

No product.

CWE

CWE-131

Incorrect Calculation of Buffer Size

4.6 /10