https://vulnogram.org/ Most recent CVEs assigned by Gallagher Group Ltd. (gallagher). https://vulnogram.org/seaview/icons/gallagher.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-27844 https://vulnogram.org/CVE-2026-27844 Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service.… Low Tue, 07 Jul 2026 03:49:34 GMT https://vulnogram.org/CVE-2026-27790 https://vulnogram.org/CVE-2026-27790 Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50… Low Tue, 07 Jul 2026 03:49:10 GMT https://vulnogram.org/CVE-2026-26053 https://vulnogram.org/CVE-2026-26053 An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centr… Medium Tue, 07 Jul 2026 03:48:47 GMT https://vulnogram.org/CVE-2026-25193 https://vulnogram.org/CVE-2026-25193 Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account… High Mon, 25 May 2026 05:28:14 GMT https://vulnogram.org/CVE-2026-20801 https://vulnogram.org/CVE-2026-20801 Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams. This issue affects all… Medium Network Exploitable Tue, 03 Mar 2026 02:41:10 GMT https://vulnogram.org/CVE-2026-20757 https://vulnogram.org/CVE-2026-20757 Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. This issue affects Command Centre Server: 9.40 prior to vEL9.40.1976(MR1), 9.30 p… Low Tue, 03 Mar 2026 02:40:45 GMT https://vulnogram.org/CVE-2025-47147 https://vulnogram.org/CVE-2025-47147 Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited dura… Medium Tue, 03 Mar 2026 02:39:30 GMT https://vulnogram.org/CVE-2025-64734 https://vulnogram.org/CVE-2025-64734 Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack against that specific reader, preventing cardholders from badging for entry.… Low Tue, 18 Nov 2025 03:26:44 GMT https://vulnogram.org/CVE-2025-52578 https://vulnogram.org/CVE-2025-52578 Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications. This issue affects Command Centre Server: 9… Medium Tue, 18 Nov 2025 03:26:20 GMT https://vulnogram.org/CVE-2025-52457 https://vulnogram.org/CVE-2025-52457 Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to… Medium Tue, 18 Nov 2025 03:25:57 GMT https://vulnogram.org/CVE-2025-48430 https://vulnogram.org/CVE-2025-48430 Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819… Medium Thu, 23 Oct 2025 03:39:31 GMT https://vulnogram.org/CVE-2025-48428 https://vulnogram.org/CVE-2025-48428 Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or… Medium Thu, 23 Oct 2025 03:39:07 GMT https://vulnogram.org/CVE-2025-47699 https://vulnogram.org/CVE-2025-47699 Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue… Critical Thu, 23 Oct 2025 03:38:46 GMT https://vulnogram.org/CVE-2025-41402 https://vulnogram.org/CVE-2025-41402 Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2),… Medium Thu, 23 Oct 2025 03:38:22 GMT https://vulnogram.org/CVE-2025-35981 https://vulnogram.org/CVE-2025-35981 Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affect… Medium Thu, 23 Oct 2025 03:37:36 GMT https://vulnogram.org/CVE-2025-46406 https://vulnogram.org/CVE-2025-46406 A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary. This issue affects Command Cent… Medium Thu, 10 Jul 2025 03:10:03 GMT https://vulnogram.org/CVE-2025-44003 https://vulnogram.org/CVE-2025-44003 Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled. This issue affects T… Medium Thu, 10 Jul 2025 03:09:43 GMT https://vulnogram.org/CVE-2025-35983 https://vulnogram.org/CVE-2025-35983 Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, th… Medium Network Exploitable Thu, 10 Jul 2025 03:09:11 GMT https://vulnogram.org/CVE-2024-41724 https://vulnogram.org/CVE-2024-41724 Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affects all versions of Gallagher Command Centre prior to 9.20.1043. High Network Exploitable Mon, 10 Mar 2025 02:44:36 GMT https://vulnogram.org/CVE-2024-43107 https://vulnogram.org/CVE-2024-43107 Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin. This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions… High Network Exploitable Mon, 10 Mar 2025 02:44:03 GMT https://vulnogram.org/CVE-2024-42407 https://vulnogram.org/CVE-2024-42407 Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This is… High Thu, 12 Dec 2024 01:36:12 GMT https://vulnogram.org/CVE-2024-41146 https://vulnogram.org/CVE-2024-41146 Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access to HBUS communication cabling to perform a Denial-of-Service attack against HBUS connected… Medium Thu, 12 Dec 2024 01:35:38 GMT https://vulnogram.org/CVE-2024-43690 https://vulnogram.org/CVE-2024-43690 Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE). This issue affects: Command Centre Server and Command Centre Workstations 9.… High Wed, 11 Sep 2024 04:04:19 GMT https://vulnogram.org/CVE-2024-39808 https://vulnogram.org/CVE-2024-39808 Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Controller wiring to instigate a reboot leading to a denial of service. This issue affects: Co… Medium Wed, 11 Sep 2024 04:03:50 GMT https://vulnogram.org/CVE-2024-24972 https://vulnogram.org/CVE-2024-24972 Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot the Controller, causing a Denial of Service. Gallagher recommend the di… Medium Network Exploitable Wed, 11 Sep 2024 04:03:18 GMT https://vulnogram.org/CVE-2024-23906 https://vulnogram.org/CVE-2024-23906 Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify Controller configuration during an authenticated Operator's session. This issue affects: C… Medium Network Exploitable Wed, 11 Sep 2024 04:02:29 GMT https://vulnogram.org/CVE-2024-23317 https://vulnogram.org/CVE-2024-23317 External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution. This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.… Medium Thu, 11 Jul 2024 02:39:28 GMT https://vulnogram.org/CVE-2024-23194 https://vulnogram.org/CVE-2024-23194 Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files. This issue affects: Gallagher Command Centre v9.10 prior to vEL9.10.1268 (MR1… Low Thu, 11 Jul 2024 02:39:08 GMT https://vulnogram.org/CVE-2024-22387 https://vulnogram.org/CVE-2024-22387 External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpected behavior that in some circumstances could compro… Medium Network Exploitable Thu, 11 Jul 2024 02:38:52 GMT https://vulnogram.org/CVE-2024-23485 https://vulnogram.org/CVE-2024-23485 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access. T… Medium Thu, 11 Jul 2024 02:38:14 GMT https://vulnogram.org/CVE-2024-22383 https://vulnogram.org/CVE-2024-22383 Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of se… Medium Tue, 05 Mar 2024 03:12:29 GMT https://vulnogram.org/CVE-2024-21838 https://vulnogram.org/CVE-2024-21838 Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.0… Medium Tue, 05 Mar 2024 03:11:55 GMT https://vulnogram.org/CVE-2024-21815 https://vulnogram.org/CVE-2024-21815 Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 p… Critical Tue, 05 Mar 2024 03:09:52 GMT https://vulnogram.org/CVE-2023-46686 https://vulnogram.org/CVE-2023-46686 A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols. This issue affects: Gallagher Diagnostics Service… Medium Mon, 18 Dec 2023 22:01:03 GMT https://vulnogram.org/CVE-2023-41967 https://vulnogram.org/CVE-2023-41967 Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration th… Low Mon, 18 Dec 2023 22:00:38 GMT https://vulnogram.org/CVE-2023-24590 https://vulnogram.org/CVE-2023-24590 A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service. This issue affects: Gallagher Controller 6000 8.60… High Network Exploitable Mon, 18 Dec 2023 22:00:17 GMT https://vulnogram.org/CVE-2023-23584 https://vulnogram.org/CVE-2023-23584 An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be viewable. This issue affects: Gallagher Command Centre 8.70 prior to vEL8.7… Medium Mon, 18 Dec 2023 21:59:58 GMT https://vulnogram.org/CVE-2023-23576 https://vulnogram.org/CVE-2023-23576 Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision. This issue affects: Gallagher Co… Medium Mon, 18 Dec 2023 21:59:38 GMT https://vulnogram.org/CVE-2023-23570 https://vulnogram.org/CVE-2023-23570 Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gallagher Command Centre 8.90 prior to vEL8.90.1620 (MR2), all versions of… Medium Mon, 18 Dec 2023 21:59:16 GMT https://vulnogram.org/CVE-2023-22439 https://vulnogram.org/CVE-2023-22439 Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service of the diagnostic web interface. This issue affects: Gallagher Control… Low Network Exploitable Mon, 18 Dec 2023 21:58:41 GMT https://vulnogram.org/CVE-2023-6355 https://vulnogram.org/CVE-2023-6355 Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug. This issue affects: Gallagher Controller 7000 9.00 prior to vCR9.00.231204b (distributed in 9.00.1507 (M… Medium Mon, 18 Dec 2023 21:55:58 GMT https://vulnogram.org/CVE-2023-23568 https://vulnogram.org/CVE-2023-23568 Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields. This issue affects Command Centre: vEL 8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2),… Medium Tue, 25 Jul 2023 01:31:59 GMT https://vulnogram.org/CVE-2023-22363 https://vulnogram.org/CVE-2023-22363 A stack-based buffer overflow in the Command Centre Server allows an attacker to cause a denial of service attack via assigning cardholders to an Access Group. This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2) Medium Mon, 24 Jul 2023 23:09:14 GMT https://vulnogram.org/CVE-2023-25074 https://vulnogram.org/CVE-2023-25074 Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies. This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 p… High Mon, 24 Jul 2023 23:05:24 GMT https://vulnogram.org/CVE-2023-22428 https://vulnogram.org/CVE-2023-22428 Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Command Centre: vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4), vEL8.60 prior to vEL8.60.23… High Mon, 24 Jul 2023 22:44:15 GMT https://vulnogram.org/CVE-2023-24584 https://vulnogram.org/CVE-2023-24584 Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all ver… High Network Exploitable Thu, 01 Jun 2023 04:08:35 GMT https://vulnogram.org/CVE-2022-26348 https://vulnogram.org/CVE-2022-26348 Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an… High Wed, 06 Jul 2022 16:29:59 GMT https://vulnogram.org/CVE-2022-26078 https://vulnogram.org/CVE-2022-26078 Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address. This issue affects: Gallagher Gallagher Controller 6000 vCR8.60 versions prior to 220303a; vCR8.50 versions prior to 220303… High Network Exploitable Wed, 06 Jul 2022 16:29:29 GMT https://vulnogram.org/CVE-2021-23193 https://vulnogram.org/CVE-2021-23193 Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Command Centre… High Thu, 18 Nov 2021 18:02:43 GMT https://vulnogram.org/CVE-2021-23197 https://vulnogram.org/CVE-2021-23197 Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.20… Medium Thu, 18 Nov 2021 18:01:52 GMT