CVE-2024-21815

Gallagher Command Centre (Gallagher) is affected by CVE-2024-21815 due to insufficiently protected credentials (CWE-522) for third‑party DVR integrations to the Command Centre Server, potentially exposing credentials to authenticated but unprivileged users. Affected versions include 8.60 and prio...

CVE-2020-16098

CVE-2020-16098 affects Gallagher Command Centre. An unauthenticated network attacker can enumerate access card credentials on: v8.20 before 8.20.1166 (MR3); v8.10 before 8.10.1211 (MR5); v8.00 before 8.00.1228 (MR6); and all 7.90 and earlier. Credentials can be used to encode low-security cards w...

CVE-2021-23230

CVE-2021-23230 describes a SQL injection vulnerability in the Gallagher Command Centre’s OPCUA interface. The root cause is lack of validation of externally entered SQL statements, allowing a remote unprivileged Command Centre Operator to modify the command center databases undetected. Affected v...

CVE-2019-15294

Gallagher Command Centre 8.10 before 8.10.1092(MR2) is affected. If, during an upgrade, a custom service account is in use and the visitor management service is installed, the Windows username and password for that service are logged in cleartext to the Command_centre.log file. This constitutes a...

CVE-2020-16096

CVE-2020-16096 (Gallagher Command Centre) affects Gallagher Command Centre versions: 8.10 before 8.10.1134(MR4), 8.00 before 8.00.1161(MR5), 7.90 before 7.90.991(MR5), 7.80 before 7.80.960(MR2), and 7.70 and earlier. The issue allows any operator account to access data that would be replicated in...

CVE-2021-23140

CVE-2021-23140 describes an Improper Authorization vulnerability in Gallagher Command Centre Server that allows an unauthorised Command Centre Operator to modify command line macros. Affected are Gallagher Command Centre: 8.40 prior to 8.40.1888 (MR3); 8.30 prior to 8.30.1359 (MR3); 8.20 prior to...