Vulnerabilities in Gallagher

70 results
CVE-2023-46686MEDIUM A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre DiaEPSS 0.5%CVE-2023-22439LOW Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) caEPSS 0.5%CVE-2023-23584MEDIUM An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence oEPSS 0.5%CVE-2023-24584HIGHController 6000 buffer overflow via upload feature in web interfaceEPSS 0.5%CVE-2021-23155CRITICALImproper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command CeEPSS 0.5%CVE-2021-23162HIGHImproper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command CEPSS 0.4%CVE-2021-23167HIGHImproper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the CommEPSS 0.4%CVE-2026-27844LOWUncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operEPSS 0.4%CVE-2026-27790LOWUncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific reqEPSS 0.4%CVE-2023-22428HIGH Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects CommaEPSS 0.4%CVE-2023-6355MEDIUM Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local EPSS 0.4%CVE-2024-24972MEDIUMBuffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authoriseEPSS 0.3%CVE-2025-47699CRITICALExposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authEPSS 0.3%CVE-2024-21815CRITICAL Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticateEPSS 0.3%CVE-2024-42407HIGHInsertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authentiEPSS 0.3%CVE-2024-41146MEDIUMUse of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker wEPSS 0.3%CVE-2023-23568MEDIUM Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields.EPSS 0.3%CVE-2023-25074HIGHCompetency access levels not enforced in the serverEPSS 0.3%CVE-2023-41967LOW Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of EPSS 0.3%CVE-2024-22387MEDIUMExternal Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticateEPSS 0.3%