High severity · published Nov 18, 2021
CVE-2021-23146
An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); 8.10 versions prior to 8.10.1284 (MR7); version 8.00 and prior versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Center · Gallagher
8.40 prior to 8.40.1888 (MR3); 8.30 prior to 8.30.1359 (MR3); 8.20 prior to 8.20.1259 (MR5); 8.10 prior to 8.10.1284 (MR7); 8.00 and prior · source: vendor
CC
Command Centre · Gallagher
through 8.00; 8.10 before 8.10.1284; 8.20 before 8.20.1259; 8.30 before 8.30.1359; 8.40 before 8.40.1888 · source: NVD