Vulnerabilidades de Gallagher
CVEs publicadas que afetam produtos de Gallagher: 12 registro(s), com severidade, exploração e correções.
Command Centre Server 7Command Centre 2Command Centre Mobile Client 1Command Centre Mobile 1Entra ID Sync 1NxWitness VMS and Hanwha VMS Integrations 1T21 Reader 1High Sec End of Line Module 1HBUS Devices 1Sip Integration 1Papercut Interface Integration 1Okta Sync 1Nexudus Integration 1Middleware Framework 1Event Sync Utility 1Event Logger 1Entra Id Sync V2 1Entra Id Sync V1 1Encoding Kiosk Application 1Elevator Service 1Diagnostics Service 1Cardholder Sync Utility 1Active Directory Sync 1Nx Witness Vms Integration 1Hanwha Vms Integration 1
CVE-2026-25193
Alta · 8.6
CWE-532 25/05/2026
Insertion of Sensitive Information into Log File em Gallagher Active Directory Sync
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.
Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted.
Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
CVE-2026-20801
Média · 5.6
CWE-319 03/03/2026
Cleartext Transmission of Sensitive Information em Gallagher Hanwha Vms Integration
Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams.
This issue affects all versions of Gallagher NxWitness VMS integration prior to 9.10.017 and Gallagher Hanwha VMS integration prior to 9.10.025.
CVE-2026-20757
Baixa · 2.5
CWE-667 03/03/2026
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a…
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server.
This issue affects Command Centre Server:
9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior.
CVE-2025-47147
Média · 5.7
CWE-312 03/03/2026
Cleartext Storage of Sensitive Information em Gallagher Command Centre Mobile
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited duration.
This issue affects Command Centre Mobile Client versions prior to 9.40.123.
CVE-2025-64734
Baixa · 2.4
CWE-772 18/11/2025
Missing Release of Resource after Effective Lifetime em Gallagher T21 Reader
Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
CVE-2025-52578
Média · 5.7
CWE-335 18/11/2025
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in…
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
CVE-2025-52457
Média · 5.7
CWE-208 18/11/2025
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with…
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security.
This issue affects Command Centre Server:
9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
CVE-2025-48430
Média · 5.5
CWE-248 23/10/2025
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and…
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVE-2025-48428
Média · 6.7
CWE-312 23/10/2025
Cleartext Storage of Sensitive Information em Gallagher Command Centre Server
Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site.
This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVE-2025-47699
Crítica · 9.9
CWE-497 23/10/2025
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in…
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.
CVE-2025-41402
Média · 5.5
CWE-602 23/10/2025
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server…
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
CVE-2025-35981
Média · 5.5
CWE-359 23/10/2025
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the…
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view.
This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).