Paper/Archive/CVE-2025-47699

CVE-2025-47699

Gallagher Command Centre Server — Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an a…

EPSS 0.3%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 27.4.274 × 205.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.

Affected

ProductAffectedFixed inSource

Command Centre Server≤ 8.90–CNA

Command Centre Server9.30 – < 9.30.2482 (MR2)9.30.2482 (MR2)CNA

Command Centre Server9.20 – < 9.20.2819 (MR4)9.20.2819 (MR4)CNA

Command Centre Server9.10 – < 9.10.3672 (MR79.10.3672 (MR7CNA

Command Centre Server9.00 – < 9.00.3831 (MR8)9.00.3831 (MR8)CNA

Scores by source

Gallagher (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsecurity.gallagher.com/en-NZ/Security-Advisories/CVE-2025-47699