CVE-2024-22387

External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpected behavior that in some circumstances could compromise site physical security controls. Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes. This issue affects: Gallagher Controller 6000 and 7000 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.

• CWE-642

• https://security.gallagher.com/Security-Advisories/CVE-2024-22387
• https://security.gallagher.com/Security-Advisories/CVE-2024-22387

Published

Jul 11, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22380Electronic Delivery Check System (Ministry of Agriculture, F…5.5
• CVE-2024-22382Improper input validation in PprRequestLog module in UEFI fi…7.5
• CVE-2024-22383 Missing release of resource after effective lifetime (CWE-7…6.2
• CVE-2024-22384Out-of-bounds read for some Intel(R) Trace Analyzer and Coll…2.8
• CVE-2024-22385Incorrect Default Permissions vulnerability in Hitachi Stora…4.4
• CVE-2024-22386A race condition was found in the Linux kernel's drm/exynos …4.7
• CVE-2024-22388Certain configuration available in the communication channel…7.8
• CVE-2024-22389When BIG-IP is deployed in high availability (HA) and an iCo…7.2
• CVE-2024-2239The Premium Addons PRO plugin for WordPress is vulnerable to…5.4
• CVE-2024-22390Improper input validation in firmware for some Intel(R) FPGA…4.4
• CVE-2024-22391A heap-based buffer overflow vulnerability exists in the Loo…9.8
• CVE-2024-22393Unrestricted Upload of File with Dangerous Type vulnerabilit…9.1