Gallagher vulnerabilities
Published CVEs affecting Gallagher products: 15 record(s), with severity, exploitation and fixes.
Command Centre Server 8Command Centre 5Controller 7000 and 6000 1Command Centre Mobile 1T-20 Readers 1Command Centre Mobile Client 1Entra ID Sync 1NxWitness VMS and Hanwha VMS Integrations 1T21 Reader 1High Sec End of Line Module 1HBUS Devices 1Sip Integration 1Papercut Interface Integration 1Okta Sync 1Nexudus Integration 1Middleware Framework 1Event Sync Utility 1Event Logger 1Entra Id Sync V2 1Entra Id Sync V1 1Encoding Kiosk Application 1Elevator Service 1Diagnostics Service 1Cardholder Sync Utility 1Active Directory Sync 1Nx Witness Vms Integration 1Hanwha Vms Integration 1
CVE-2026-27844
Low · 2.7
CWE-248 Jul 7, 2026
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web…
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service.
Version of Command Centre affected:
* 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
* 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3))
* 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))
* 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))
* all versions of 9.10 and prior.
CVE-2026-27790
Low · 2.7
CWE-248 Jul 7, 2026
Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized…
Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected:
* 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
* 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3))
* 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))
* 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))
* all versions of 9.10 and prior.
CVE-2026-26053
Medium · 5.3
CWE-266 Jul 7, 2026
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server…
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.
CVE-2026-25193
High · 8.6
CWE-532 May 25, 2026
Insertion of Sensitive Information into Log File in Gallagher Active Directory Sync
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.
Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted.
Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
CVE-2026-20801
Medium · 5.6
CWE-319 Mar 3, 2026
Cleartext Transmission of Sensitive Information in Gallagher Hanwha Vms Integration
Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams.
This issue affects all versions of Gallagher NxWitness VMS integration prior to 9.10.017 and Gallagher Hanwha VMS integration prior to 9.10.025.
CVE-2026-20757
Low · 2.5
CWE-667 Mar 3, 2026
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a…
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server.
This issue affects Command Centre Server:
9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior.
CVE-2025-47147
Medium · 5.7
CWE-312 Mar 3, 2026
Cleartext Storage of Sensitive Information in Gallagher Command Centre Mobile
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited duration.
This issue affects Command Centre Mobile Client versions prior to 9.40.123.
CVE-2025-64734
Low · 2.4
CWE-772 Nov 18, 2025
Missing Release of Resource after Effective Lifetime in Gallagher T21 Reader
Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
CVE-2025-52578
Medium · 5.7
CWE-335 Nov 18, 2025
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in…
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
CVE-2025-52457
Medium · 5.7
CWE-208 Nov 18, 2025
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with…
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
CVE-2025-48430
Medium · 5.5
CWE-248 Oct 23, 2025
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and…
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVE-2025-48428
Medium · 6.7
CWE-312 Oct 23, 2025
Cleartext Storage of Sensitive Information in Gallagher Command Centre Server
Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site.
This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVE-2025-47699
Critical · 9.9
CWE-497 Oct 23, 2025
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in…
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVE-2025-41402
Medium · 5.5
CWE-602 Oct 23, 2025
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server…
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
CVE-2025-35981
Medium · 5.5
CWE-359 Oct 23, 2025
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the…
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view.
This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).