description:
Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service.
This issue affects: All variants of the Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507(MR1)), 8.90 prior to vCR8.90.240209b (distributed in 8.90.1751 (MR3)), 8.80 prior to vCR8.80.240209a (distributed in 8.80.1526 (MR4)), 8.70 prior to vCR8.70.240209a (distributed in 8.70.2526 (MR6)).
problem types: CWE-772 Missing Release of Resource after Effective Lifetime
affected:
{
defaultStatus: unaffected
product: Controller 7000
vendor: Gallagher
versions:
lessThan: vCR9.00.231204b, status: affected, version: 9.00, versionType: custom
lessThan: vCR8.90.240209b, status: affected, version: 8.90, versionType: custom
lessThan: vCR8.80.240209a, status: affected, version: 8.80, versionType: custom
lessThan: vCR8.70.240209a, status: affected, version: 8.70, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL