CVE-2024-21815

State: Published
Severity: 9.1 Critical
Published: Mar 5, 2024
Updated: Aug 1, 2024
Reserved: Feb 5, 2024

Description

Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users.

This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L	Gallagher

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
Command Centre ServerGallagher	8.60 and earlierAffected 9.00 to before vEL9.00.1774 (MR2)Affected 8.90 to before vEL8.90.1751 (MR3)Affected 8.80 to before vEL8.80.1526 (MR4)Affected 8.70 to before vEL8.70.2526 (MR6)Affected

References

https://security.gallagher.com/Security-Advisories/CVE-2024-21815

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.