Paper/Archive/CVE-2024-21815

CVE-2024-21815

Gallagher Command Centre Server — Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authentica…

EPSS 0.3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 26.8.268 × 205.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.

Affected

ProductAffectedFixed inSource

Command Centre Server≤ 8.60–CNA

Command Centre Server9.00 – < vEL9.00.1774 (MR2)vEL9.00.1774 (MR2)CNA

Command Centre Server8.90 – < vEL8.90.1751 (MR3)vEL8.90.1751 (MR3)CNA

Command Centre Server8.80 – < vEL8.80.1526 (MR4)vEL8.80.1526 (MR4)CNA

Command Centre Server8.70 – < vEL8.70.2526 (MR6)vEL8.70.2526 (MR6)CNA

Scores by source

Gallagher (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsecurity.gallagher.com/Security-Advisories/CVE-2024-21815