Insufficiently protected credentials in Gallagher Command Centre Server
Priority LOW 39CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix Fixed Command Centre Server (Gallagher): vEL9.00.1774 (MR2), vEL8.90.1751 (MR3), vEL8.80.1526 (MR4) +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Gallagher | Command Centre Server | up to 8.60; 9.00 to before vEL9.00.1774 (MR2); 8.90 to before vEL8.90.1751 (MR3); 8.80 to before vEL8.80.1526 (MR4); 8.70 to before vEL8.70.2526 (MR6) | vEL9.00.1774 (MR2), vEL8.90.1751 (MR3), vEL8.80.1526 (MR4), vEL8.70.2526 (MR6) | Patch available | CNA |
- Command Centre Server VendorGallagher Affected up to 8.60; 9.00 to before vEL9.00.1774 (MR2); 8.90 to before vEL8.90.1751 (MR3); 8.80 to before vEL8.80.1526 (MR4); 8.70 to before vEL8.70.2526 (MR6) Fixed in vEL9.00.1774 (MR2), vEL8.90.1751 (MR3), vEL8.80.1526 (MR4), vEL8.70.2526 (MR6) Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* | up to 8.60; 8.70 to before 8.70.2526; 8.80 to before 8.80.1526; 8.90 to before 8.90.1751; 9.00 to before 9.00.1774 | Vulnerable | Gallagher |
- cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* Versions up to 8.60; 8.70 to before 8.70.2526; 8.80 to before 8.80.1526; 8.90 to before 8.90.1751; 9.00 to before 9.00.1774 Vulnerable ·Gallagher
Remediation
- Fix · CNA Command Centre Server (Gallagher) Fixed in vEL9.00.1774 (MR2), vEL8.90.1751 (MR3), vEL8.80.1526 (MR4), vEL8.70.2526 (MR6)
Timeline
- 2026-10-02 Threatist record created from CVE-2024-21815
- 2026-10-03 Alias added: GHSA-cg32-2535-p88w
References
More Gallagher Command Centre vulnerabilities
- TI-2021-05931 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
- TI-2020-12668 Improper authentication in Gallagher Command Centre CVSS 3.1CRITICAL 9.8
- TI-2020-12666 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
- TI-2019-11404 An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). CVSS 3.0CRITICAL 9.8
- TI-2021-05986 SQL injection in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
- TI-2020-12673 Incorrect type conversion in Gallagher Command Centre CVSS 3.1HIGH 8.8
Sources
- CVE-2024-21815 · CVE Program
- CVE-2024-21815 · NVD
- FIRST EPSS
- GHSA-cg32-2535-p88w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences