Gallagher
Gallagher Command Centre: vulnerabilidades y CVE
Gallagher Command Centre tiene 45 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE45
Últimos 12 meses5
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-27844 | Baja (2.7) | 0.39% | — | 7 jul 2026 | Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in… |
| CVE-2026-27790 | Baja (2.7) | 0.39% | — | 7 jul 2026 | Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre… |
| CVE-2026-26053 | Media (5.3) | 0.25% | — | 7 jul 2026 | An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to… |
| CVE-2026-25193 | Alta (8.6) | 0.14% | — | 25 may 2026 | Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services… |
| CVE-2026-20757 | Baja (2.5) | 0.07% | — | 3 mar 2026 | Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. This issue affects Command Centre Server: 9.40… |
| CVE-2024-41724 | Alta (8.7) | 0.19% | — | 10 mar 2025 | Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affects all versions of Gallagher Command Centre prior to 9.20.1043. |
| CVE-2024-42407 | Alta (8.5) | 0.32% | — | 12 dic 2024 | Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have… |
| CVE-2024-23194 | Baja (3.3) | 0.15% | — | 11 jul 2024 | Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. This issue affects: Gallagher Command Centre… |
| CVE-2024-21838 | Media (5.4) | 0.30% | — | 5 mar 2024 | Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue… |
| CVE-2024-21815 | Media (6.5) | 0.33% | — | 5 mar 2024 | Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00… |
| CVE-2023-46686 | Alta (7.1) | 0.52% | — | 18 dic 2023 | A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols. This issue affects:… |
| CVE-2023-23584 | Media (4.3) | 0.50% | — | 18 dic 2023 | An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable. This issue affects: Gallagher… |
| CVE-2023-23576 | Media (4.3) | 0.28% | — | 18 dic 2023 | Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision.… |
| CVE-2023-23570 | Alta (8.1) | 0.67% | — | 18 dic 2023 | Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gallagher Command Centre 8.90 prior to… |
| CVE-2023-22439 | Media (4.3) | 0.51% | — | 18 dic 2023 | Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This… |
| CVE-2023-23568 | Media (5.4) | 0.31% | — | 25 jul 2023 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affects Command Centre: vEL 8.90 prior to vEL8.90.1318 (MR1),… |
| CVE-2023-25074 | Media (5.4) | 0.31% | — | 25 jul 2023 | Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior… |
| CVE-2023-22363 | Alta (7.5) | 0.60% | — | 25 jul 2023 | A stack-based buffer overflow in the Command Centre Server allows an attacker to cause a denial of service attack via assigning cardholders to an Access Group. This issue affects Command Centre: vEL8.80 prior to… |
| CVE-2023-22428 | Media (6.5) | 0.36% | — | 24 jul 2023 | Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185… |
| CVE-2022-26348 | Media (5.5) | 0.27% | — | 6 jul 2022 | Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application… |
| CVE-2021-23197 | Alta (7.8) | 0.27% | — | 18 nov 2021 | — |
| CVE-2021-23193 | Media (6.5) | 0.70% | — | 18 nov 2021 | Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensitive information from the Command Centre Server. This issue… |
| CVE-2021-23167 | Media (6.8) | 0.40% | — | 18 nov 2021 | Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Command Centre 8.50 versions… |
| CVE-2021-23146 | Alta (7.5) | 0.88% | — | 18 nov 2021 | An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3);… |
| CVE-2021-23230 | Media (4.3) | 0.66% | — | 11 jun 2021 | A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command… |
| CVE-2021-23211 | Media (4.4) | 0.11% | — | 11 jun 2021 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key to be discoverable in server memory dumps. This issue affects: Gallagher… |
| CVE-2021-23205 | Alta (8.1) | 0.87% | — | 11 jun 2021 | Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers and other hardware items beyond their privilege. This issue affects: Gallagher… |
| CVE-2021-23204 | Media (6.5) | 0.70% | — | 11 jun 2021 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be exposed to Command Centre Operators. This issue affects: Gallagher Command… |
| CVE-2021-23182 | Media (4.4) | 0.17% | — | 11 jun 2021 | Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in server memory dumps. This issue affects: Gallagher Command… |
| CVE-2021-23140 | Alta (8.8) | 0.85% | — | 11 jun 2021 | Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator. This issue affects: Gallagher Command Centre 8.40 versions… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Gallagher
Controller 6000 Firmware · 5Controller 7000 · 4Controller 6000 · 3Command Centre Server · 2Command Centre Mobile Connect · 1Cardholder Sync Utility · 1Command Centre Mobile Client · 1Command Centre Mobile · 1Aperio Communication HUB · 1Controller 7000 Firmware · 1Diagnostics Service · 1Active Directory Sync · 1