Gallagher

Latest CVEs · RSS

• CVE-2026-27844 2026-07-07 · CVSS 2.7
  Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Co
• CVE-2026-27790 2026-07-07 · CVSS 2.7
  Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in
• CVE-2026-26053 2026-07-07 · CVSS 5.3
  An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some
• CVE-2026-25193 2026-05-25 · CVSS 8.1
  Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitiga
• CVE-2026-20801 2026-03-03 · CVSS 5.6
  Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unpriv
• CVE-2026-20757 2026-03-03 · CVSS 2.5
  Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre
• CVE-2025-47147 2026-03-03 · CVSS 5.7
  Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in O
• CVE-2025-64734 2025-11-18 · CVSS 2.4
  Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-se
• CVE-2025-52578 2025-11-18 · CVSS 5.7
  Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access,
• CVE-2025-52457 2025-11-18 · CVSS 5.7
  Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially co
• CVE-2025-48430 2025-10-23 · CVSS 5.5
  Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue a
• CVE-2025-48428 2025-10-23 · CVSS 6.7
  Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Ser
• CVE-2025-47699 2025-10-23 · CVSS 9.9
  Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator w
• CVE-2025-41402 2025-10-23 · CVSS 5.5
  Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing
• CVE-2025-35981 2025-10-23 · CVSS 5.5
  Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal d
• CVE-2025-46406 2025-07-10 · CVSS 5.6
  A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform l
• CVE-2025-44003 2025-07-10 · CVSS 4.3
  Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform
• CVE-2025-35983 2025-07-10 · CVSS 6.5
  Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of serv
• CVE-2024-41724 2025-03-10 · CVSS 8.7
  Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affec
• CVE-2024-43107 2025-03-10 · CVSS 7.2
  Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to
• CVE-2024-42407 2024-12-12 · CVSS 8.5
  Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to vi
• CVE-2024-41146 2024-12-12 · CVSS 4.6
  Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access
• CVE-2024-43690 2024-09-11 · CVSS 8.0
  Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Exe
• CVE-2024-39808 2024-09-11 · CVSS 4.6
  Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Cont
• CVE-2024-24972 2024-09-11 · CVSS 6.5
  Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated