Sensitive information in log files in Gallagher Command Centre Server
Priority LOW 36CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-532.
Summary
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix Fixed Command Centre Server (Gallagher): 9.40.2575 (MR2)Active Directory Sync (Gallagher): 9.10.05+12 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Gallagher | Command Centre Server | 9.40 to before 9.40.2575 (MR2) | 9.40.2575 (MR2) | Patch available | CNA |
| Gallagher | Active Directory Sync | before 9.10.05 | 9.10.05 | Patch available | CNA |
| Gallagher | Cardholder Sync Utility | before 9.30.104 | 9.30.104 | Patch available | CNA |
| Gallagher | Diagnostics Service | before 2.0.9 | 2.0.9 | Patch available | CNA |
| Gallagher | Elevator Service | before 10.0.8 | 10.0.8 | Patch available | CNA |
| Gallagher | Encoding Kiosk Application | before 9.60.10 | 9.60.10 | Patch available | CNA |
| Gallagher | Entra ID Sync | 1.0 to before 1.0.10; 2.0 to before 2.0.5 | 1.0.10, 2.0.5 | Patch available | CNA |
| Gallagher | Event Sync Utility | before 8.70.62 | 8.70.62 | Patch available | CNA |
| Gallagher | Event Logger | before 8.90.16 | 8.90.16 | Patch available | CNA |
| Gallagher | Middleware Framework | before 8.90.34 | 8.90.34 | Patch available | CNA |
| Gallagher | Nexudus Integration | before 9.60.21 | 9.60.21 | Patch available | CNA |
| Gallagher | Okta Sync | before 9.40.05 | 9.40.05 | Patch available | CNA |
| Gallagher | Papercut Interface Integration | before 9.60.02 | 9.60.02 | Patch available | CNA |
| Gallagher | SIP Integration | before 10.1.0 | 10.1.0 | Patch available | CNA |
- Command Centre Server VendorGallagher Affected 9.40 to before 9.40.2575 (MR2) Fixed in 9.40.2575 (MR2) Patch available CNA
- Active Directory Sync VendorGallagher Affected before 9.10.05 Fixed in 9.10.05 Patch available CNA
- Cardholder Sync Utility VendorGallagher Affected before 9.30.104 Fixed in 9.30.104 Patch available CNA
- Diagnostics Service VendorGallagher Affected before 2.0.9 Fixed in 2.0.9 Patch available CNA
- Elevator Service VendorGallagher Affected before 10.0.8 Fixed in 10.0.8 Patch available CNA
- Encoding Kiosk Application VendorGallagher Affected before 9.60.10 Fixed in 9.60.10 Patch available CNA
- Entra ID Sync VendorGallagher Affected 1.0 to before 1.0.10; 2.0 to before 2.0.5 Fixed in 1.0.10, 2.0.5 Patch available CNA
- Event Sync Utility VendorGallagher Affected before 8.70.62 Fixed in 8.70.62 Patch available CNA
- Event Logger VendorGallagher Affected before 8.90.16 Fixed in 8.90.16 Patch available CNA
- Middleware Framework VendorGallagher Affected before 8.90.34 Fixed in 8.90.34 Patch available CNA
- Nexudus Integration VendorGallagher Affected before 9.60.21 Fixed in 9.60.21 Patch available CNA
- Okta Sync VendorGallagher Affected before 9.40.05 Fixed in 9.40.05 Patch available CNA
- Papercut Interface Integration VendorGallagher Affected before 9.60.02 Fixed in 9.60.02 Patch available CNA
- SIP Integration VendorGallagher Affected before 10.1.0 Fixed in 10.1.0 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gallagher:active_directory_sync:*:*:*:*:*:command_centre:*:* | before 9.10.05 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:cardholder_sync_utility:*:*:*:*:*:command_centre:*:* | before 9.30.104 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* | before 9.40.2575 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:diagnostics_service:*:*:*:*:*:command_centre:*:* | before 2.0.9 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:elevator_service:*:*:*:*:*:command_centre:*:* | before 10.0.8 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:encoding_kiosk_application:*:*:*:*:*:command_centre:*:* | before 9.60.10 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:entra_id_sync_v1:*:*:*:*:*:command_centre:*:* | before 1.0.10 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:entra_id_sync_v2:*:*:*:*:*:command_centre:*:* | before 2.0.5 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:event_logger:*:*:*:*:*:command_centre:*:* | before 8.90.16 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:event_sync_utility:*:*:*:*:*:command_centre:*:* | before 8.70.62 | Vulnerable | Gallagher |
- cpe:2.3:a:gallagher:active_directory_sync:*:*:*:*:*:command_centre:*:* Versions before 9.10.05 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:cardholder_sync_utility:*:*:*:*:*:command_centre:*:* Versions before 9.30.104 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* Versions before 9.40.2575 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:diagnostics_service:*:*:*:*:*:command_centre:*:* Versions before 2.0.9 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:elevator_service:*:*:*:*:*:command_centre:*:* Versions before 10.0.8 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:encoding_kiosk_application:*:*:*:*:*:command_centre:*:* Versions before 9.60.10 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:entra_id_sync_v1:*:*:*:*:*:command_centre:*:* Versions before 1.0.10 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:entra_id_sync_v2:*:*:*:*:*:command_centre:*:* Versions before 2.0.5 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:event_logger:*:*:*:*:*:command_centre:*:* Versions before 8.90.16 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:event_sync_utility:*:*:*:*:*:command_centre:*:* Versions before 8.70.62 Vulnerable ·Gallagher
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gallagher:middleware_framework:*:*:*:*:*:command_centre:*:* | before 8.90.34 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:nexudus_integration:*:*:*:*:*:command_centre:*:* | before 9.60.21 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:okta_sync:*:*:*:*:*:command_centre:*:* | before 9.40.05 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:papercut_interface_integration:*:*:*:*:*:command_centre:*:* | before 9.60.02 | Vulnerable | Gallagher |
| cpe:2.3:a:gallagher:sip_integration:*:*:*:*:*:command_centre:*:* | before 10.10 | Vulnerable | Gallagher |
- cpe:2.3:a:gallagher:middleware_framework:*:*:*:*:*:command_centre:*:* Versions before 8.90.34 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:nexudus_integration:*:*:*:*:*:command_centre:*:* Versions before 9.60.21 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:okta_sync:*:*:*:*:*:command_centre:*:* Versions before 9.40.05 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:papercut_interface_integration:*:*:*:*:*:command_centre:*:* Versions before 9.60.02 Vulnerable ·Gallagher
- cpe:2.3:a:gallagher:sip_integration:*:*:*:*:*:command_centre:*:* Versions before 10.10 Vulnerable ·Gallagher
Remediation
- Fix · CNA Command Centre Server (Gallagher) Fixed in 9.40.2575 (MR2)
- Fix · CNA Active Directory Sync (Gallagher) Fixed in 9.10.05
- Fix · CNA Cardholder Sync Utility (Gallagher) Fixed in 9.30.104
- Fix · CNA Diagnostics Service (Gallagher) Fixed in 2.0.9
- Fix · CNA Elevator Service (Gallagher) Fixed in 10.0.8
- Fix · CNA Encoding Kiosk Application (Gallagher) Fixed in 9.60.10
- Fix · CNA Entra ID Sync (Gallagher) Fixed in 1.0.10, 2.0.5
- Fix · CNA Event Sync Utility (Gallagher) Fixed in 8.70.62
- Fix · CNA Event Logger (Gallagher) Fixed in 8.90.16
- Fix · CNA Middleware Framework (Gallagher) Fixed in 8.90.34
- Fix · CNA Nexudus Integration (Gallagher) Fixed in 9.60.21
- Fix · CNA Okta Sync (Gallagher) Fixed in 9.40.05
- Fix · CNA Papercut Interface Integration (Gallagher) Fixed in 9.60.02
- Fix · CNA SIP Integration (Gallagher) Fixed in 10.1.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25193
- 2026-10-03 Alias added: GHSA-5p63-2cwc-2x43
References
Sources
- CVE-2026-25193 · CVE Program
- CVE-2026-25193 · NVD
- FIRST EPSS
- GHSA-5p63-2cwc-2x43 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences