Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized…
Priority LOW 14CWE-248Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.
Summary
Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed T-20 Readers (Gallagher): vCR9.50.260616a, vCR9.40.260616a, vCR9.30.260616a +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Gallagher | T-20 Readers | up to 9.10; 9.50 to before vCR9.50.260616a; 9.40 to before vCR9.40.260616a; 9.30 to before vCR9.30.260616a; 9.20 to before vCR9.20.260616a | vCR9.50.260616a, vCR9.40.260616a, vCR9.30.260616a, vCR9.20.260616a | Patch available | CNA |
- T-20 Readers VendorGallagher Affected up to 9.10; 9.50 to before vCR9.50.260616a; 9.40 to before vCR9.40.260616a; 9.30 to before vCR9.30.260616a; 9.20 to before vCR9.20.260616a Fixed in vCR9.50.260616a, vCR9.40.260616a, vCR9.30.260616a, vCR9.20.260616a Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* | before 9.20.4349; 9.30.1594 to before 9.30.3983; 9.40.1359 to before 9.40.3130; 9.50.978 to before 9.50.1587 | Vulnerable | Gallagher |
| cpe:2.3:h:gallagher:high_sec_t20_reader:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Gallagher |
| cpe:2.3:h:gallagher:high_sec_t20_reader_multi_tech:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Gallagher |
| cpe:2.3:h:gallagher:t20_alarms_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Gallagher |
| cpe:2.3:h:gallagher:t20_mifare_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Gallagher |
| cpe:2.3:h:gallagher:t20_multi_tech_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Gallagher |
- cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* Versions before 9.20.4349; 9.30.1594 to before 9.30.3983; 9.40.1359 to before 9.40.3130; 9.50.978 to before 9.50.1587 Vulnerable ·Gallagher
- cpe:2.3:h:gallagher:high_sec_t20_reader:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gallagher
- cpe:2.3:h:gallagher:high_sec_t20_reader_multi_tech:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gallagher
- cpe:2.3:h:gallagher:t20_alarms_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gallagher
- cpe:2.3:h:gallagher:t20_mifare_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gallagher
- cpe:2.3:h:gallagher:t20_multi_tech_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gallagher
Remediation
- Fix · CNA T-20 Readers (Gallagher) Fixed in vCR9.50.260616a, vCR9.40.260616a, vCR9.30.260616a, vCR9.20.260616a
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27790
- 2026-10-03 Alias added: GHSA-56pq-38g7-f784
References
More Gallagher Command Centre vulnerabilities
- TI-2021-05931 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
- TI-2020-12668 Improper authentication in Gallagher Command Centre CVSS 3.1CRITICAL 9.8
- TI-2020-12666 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
- TI-2019-11404 An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). CVSS 3.0CRITICAL 9.8
- TI-2021-05986 SQL injection in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
- TI-2020-12673 Incorrect type conversion in Gallagher Command Centre CVSS 3.1HIGH 8.8
Sources
- CVE-2026-27790 · CVE Program
- CVE-2026-27790 · NVD
- FIRST EPSS
- GHSA-56pq-38g7-f784 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences