Medium severity · published Mar 5, 2024
CVE-2024-21815
Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users.
This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Centre Server · Gallagher
through 8.60; 9.00 before vEL9.00.1774 (MR2); 8.90 before vEL8.90.1751 (MR3); 8.80 before vEL8.80.1526 (MR4); 8.70 before vEL8.70.2526 (MR6) · source: vendor
CC
Command Centre · Gallagher
through 8.60; 8.70 before 8.70.2526; 8.80 before 8.80.1526; 8.90 before 8.90.1751; 9.00 before 9.00.1774 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21815
Vendor Advisory
https://security.gallagher.com/Security-Advisories/CVE-2024-21815
More from Command Centre Server
9.9
CVE-2025-47699
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site…
8.7
CVE-2024-41724
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server
8.6
CVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only…
8.5
CVE-2024-42407
Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security…
8.0
CVE-2024-43690
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE)