disclosures@gallagher.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS disclosures@gallagher.com
03
assessed vulnerabilities (70)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27844US | — | — | ||
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by… | ||||
| CVE-2026-27790US | — | — | ||
Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial o… | ||||
| CVE-2026-26053US | — | — | ||
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they… | ||||
| CVE-2026-25193US | high8.6 | — | ||
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.
Mitigating Factor: Only si… | ||||
| CVE-2026-20801US | —OT elevated | — | ||
Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with lo… | ||||
| CVE-2026-20757US | — | — | ||
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server.
This iss… | ||||
| CVE-2025-47147US | —OT elevated | — | ||
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile dev… | ||||
| CVE-2025-64734US | — | — | ||
Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack against… | ||||
| CVE-2025-52578US | — | — | ||
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise inter… | ||||
| CVE-2025-52457US | — | — | ||
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further s… | ||||
| CVE-2025-48430US | — | — | ||
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.
This issue affects Command Centr… | ||||
| CVE-2025-48428US | —OT elevated | — | ||
Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a spec… | ||||
| CVE-2025-47699US | — | — | ||
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site per… | ||||
| CVE-2025-41402US | — | — | ||
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks.
Thi… | ||||
| CVE-2025-35981US | — | — | ||
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardhold… | ||||
| CVE-2025-46406US | — | — | ||
A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged ac… | ||||
| CVE-2025-44003US | — | — | ||
Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of… | ||||
| CVE-2025-35983US | — | — | ||
Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privi… | ||||
| CVE-2024-43107US | — | — | ||
Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin.
This is… | ||||
| CVE-2024-41724US | — | — | ||
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server.
This issue affects all versions of G… | ||||