Gallagher vulnerabilities
70 CVEs and advisories name Gallagher as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-22383 Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not au
- CVE-2024-21838 Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead
- CVE-2024-21815 Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticate
- CVE-2023-46686 A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Dia
- CVE-2023-41967 Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of
- CVE-2023-24590 A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some insta
- CVE-2023-23584 An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence o
- CVE-2023-23576 Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than inte
- CVE-2023-23570 Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with unde
- CVE-2023-22439 Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) ca
- CVE-2023-6355 Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local
- CVE-2023-23568 Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields.
- CVE-2023-22363Access Zone stack overflow
- CVE-2023-25074Competency access levels not enforced in the server
- CVE-2023-22428 Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage.
- CVE-2023-24584Controller 6000 buffer overflow via upload feature in web interface
- CVE-2022-26348Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server.
- CVE-2022-26078Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address.
- CVE-2021-23193Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators
- CVE-2021-23197Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account
- CVE-2021-23167Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Comm
- CVE-2021-23146An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification.
- CVE-2021-23162Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command C
- CVE-2021-23155Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Ce
- CVE-2021-23230A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to mod
- CVE-2021-23211Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key
- CVE-2021-23205Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers
- CVE-2021-23204Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be e
- CVE-2021-23182Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be d
- CVE-2021-23140Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command