CVE-2024-41146

Dec. 12, 2024, 2:15 a.m.

4.6
Medium

Description

Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access to HBUS communication cabling to perform a Denial-of-Service attack against HBUS connected devices, require a device reboot to resolve. This issue affects: Controller 6000 and Controller 7000 firmware versions 9.10 prior to vCR9.10.241108a (distributed in 9.10.2149 (MR4)), 9.00 prior to vCR9.00.241108a (distributed in 9.00.2374 (MR5)), 8.90 prior to vCR8.90.241107a (distributed in 8.90.2356 (MR6)), all versions of 8.80 and prior.

Product(s) Impacted

Product Versions
Controller 6000
  • ['9.10 prior to vCR9.10.241108a (distributed in 9.10.2149 (MR4))', '9.00 prior to vCR9.00.241108a (distributed in 9.00.2374 (MR5))', '8.90 prior to vCR8.90.241107a (distributed in 8.90.2356 (MR6))', 'all versions of 8.80 and prior']
Controller 7000
  • ['9.10 prior to vCR9.10.241108a (distributed in 9.10.2149 (MR4))', '9.00 prior to vCR9.00.241108a (distributed in 9.00.2374 (MR5))', '8.90 prior to vCR8.90.241107a (distributed in 8.90.2356 (MR6))', 'all versions of 8.80 and prior']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-694
Use of Multiple Resources with Duplicate Identifier
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-41146

Tags

disclosures@gallagher.com
2024-12-12
CVE-2024-41146
CWE-694

CVSS Score

4.6 / 10

CVSS Data - 3.1

  • Attack Vector: PHYSICAL
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH

    • CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    View Vector String

Timeline

Published: Dec. 12, 2024, 2:15 a.m.
Last Modified: Dec. 12, 2024, 2:15 a.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

disclosures@gallagher.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.