Login Request a demo
GA
Vendor
Gallagher
38 products with CVEs on record
113
CVEs
0
On KEV
0
New 30D
Products
CC
Command Centre
Gallagher
9.8
44 CVEs0 on KEV0 new
CC
Command Centre Server
Gallagher
9.9
16 CVEs0 on KEV0 new
C6
Controller 6000 and Controller 7000
Gallagher
6.8
7 CVEs0 on KEV0 new
C6
Controller 6000 Firmware
Gallagher
9.8
6 CVEs0 on KEV0 new
C6
Controller 6000
Gallagher
9.8
3 CVEs0 on KEV0 new
C7
Controller 7000
Gallagher
6.8
3 CVEs0 on KEV0 new
CC
Command Centre Mobile Client
Gallagher
6.8
2 CVEs0 on KEV0 new
C7
Controller 7000 Firmware
Gallagher
6.8
2 CVEs0 on KEV0 new
AD
Active Directory Sync
Gallagher
8.6
1 CVEs0 on KEV0 new
CS
Cardholder Sync Utility
Gallagher
8.6
1 CVEs0 on KEV0 new
CC
Command Centre Diagnostics Service
Gallagher
7.1
1 CVEs0 on KEV0 new
CC
Command Centre Mobile
Gallagher
5.7
1 CVEs0 on KEV0 new
CC
Command Centre Mobile Connect
Gallagher
8.1
1 CVEs0 on KEV0 new
C6
Controller 6000/ Controller 7000
Gallagher
4.3
1 CVEs0 on KEV0 new
C7
Controller 7000 and 6000
Gallagher
2.7
1 CVEs0 on KEV0 new
DS
Diagnostics Service
Gallagher
8.6
1 CVEs0 on KEV0 new
ES
Elevator Service
Gallagher
8.6
1 CVEs0 on KEV0 new
EK
Encoding Kiosk Application
Gallagher
8.6
1 CVEs0 on KEV0 new
EI
Entra ID Sync
Gallagher
8.6
1 CVEs0 on KEV0 new
EI
Entra ID Sync V1
Gallagher
8.6
1 CVEs0 on KEV0 new
EI
Entra ID Sync V2
Gallagher
8.6
1 CVEs0 on KEV0 new
EL
Event Logger
Gallagher
8.6
1 CVEs0 on KEV0 new
ES
Event Sync Utility
Gallagher
8.6
1 CVEs0 on KEV0 new
GC
Gallagher Controller 6000
Gallagher
7.5
1 CVEs0 on KEV0 new
HV
Hanwha Vms Integration
Gallagher
5.6
1 CVEs0 on KEV0 new
HD
HBUS Devices
Gallagher
5.7
1 CVEs0 on KEV0 new
HS
High Sec End of Line Module
Gallagher
5.7
1 CVEs0 on KEV0 new
MF
Middleware Framework
Gallagher
8.6
1 CVEs0 on KEV0 new
MI
Milestone Integration Plugin
Gallagher
7.2
1 CVEs0 on KEV0 new
NI
Nexudus Integration
Gallagher
8.6
1 CVEs0 on KEV0 new
NW
NX Witness Vms Integration
Gallagher
5.6
1 CVEs0 on KEV0 new
NV
NxWitness VMS and Hanwha VMS Integrations
Gallagher
5.6
1 CVEs0 on KEV0 new
OS
Okta Sync
Gallagher
8.6
1 CVEs0 on KEV0 new
PI
Papercut Interface Integration
Gallagher
8.6
1 CVEs0 on KEV0 new
SI
SIP Integration
Gallagher
8.6
1 CVEs0 on KEV0 new
TR
T-20 Readers
Gallagher
2.7
1 CVEs0 on KEV0 new
TR
T-Series Readers
Gallagher
4.3
1 CVEs0 on KEV0 new
TR
T21 Reader
Gallagher
2.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-27844
C7
Controller 7000 and 6000
Gallagher
2.7
0%
Jul 7Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by…
CVE-2026-27790
TR
T-20 Readers
Gallagher
2.7
0%
Jul 7Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial…
CVE-2026-26053
CC
Command Centre Server
Gallagher
5.3
0%
Jul 7An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that…
CVE-2026-25193
OS
Okta Sync
Gallagher
8.6
0%
May 25Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only…
CVE-2026-20801
NV
NxWitness VMS and Hanwha VMS Integrations
Gallagher
5.6
0%
Mar 3Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with…
CVE-2026-20757
CC
Command Centre Server
Gallagher
2.5
0%
Mar 3Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server
CVE-2025-47147
CC
Command Centre Mobile Client
Gallagher
5.7
0%
Mar 3Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile…
CVE-2025-64734
TR
T21 Reader
Gallagher
2.4
0%
Nov 18Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack…
CVE-2025-52578
HS
High Sec End of Line Module
Gallagher
5.7
0%
Nov 18Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise…
CVE-2025-52457
HD
HBUS Devices
Gallagher
5.7
0%
Nov 18Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further…
CVE-2025-48430
CC
Command Centre Server
Gallagher
5.5
0%
Oct 23Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will
CVE-2025-48428
CC
Command Centre Server
Gallagher
6.7
0%
Oct 23Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a…
CVE-2025-47699
CC
Command Centre Server
Gallagher
9.9
0%
Oct 23Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site…
CVE-2025-41402
CC
Command Centre Server
Gallagher
5.5
0%
Oct 23Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks
CVE-2025-35981
CC
Command Centre Server
Gallagher
5.5
0%
Oct 23Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a…
CVE-2025-46406
CC
Command Centre Server
Gallagher
5.6
0%
Jul 10A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged…
CVE-2025-44003
TR
T-Series Readers
Gallagher
4.3
0%
Jul 10Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial…
CVE-2025-35983
C7
Controller 7000
Gallagher
6.5
0%
Jul 10Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform…
CVE-2024-41724
CC
Command Centre Server
Gallagher
8.7
0%
Mar 10Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server
CVE-2024-43107
MI
Milestone Integration Plugin
Gallagher
7.2
0%
Mar 10Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g
CVE-2024-42407
CC
Command Centre Server
Gallagher
8.5
0%
Dec 12Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security…
CVE-2024-41146
C6
Controller 6000 and Controller 7000
Gallagher
4.6
0%
Dec 12Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access to HBUS…
CVE-2024-43690
CC
Command Centre Server
Gallagher
8.0
1%
Sep 11Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE)
CVE-2024-39808
C6
Controller 6000 and Controller 7000
Gallagher
4.6
0%
Sep 11Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with physical access to Controller wiring to…
CVE-2024-24972
C6
Controller 6000 and Controller 7000
Gallagher
6.5
0%
Sep 11Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot…
CVE-2024-23906
C6
Controller 6000 and Controller 7000
Gallagher
6.1
0%
Sep 11Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify Controller…
CVE-2024-23317
C6
Controller 6000 and Controller 7000
Gallagher
6.3
0%
Jul 11External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code…
CVE-2024-23194
CC
Command Centre
Gallagher
3.3
0%
Jul 11Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to modify Command Centre log files
CVE-2024-22387
C6
Controller 6000 and Controller 7000
Gallagher
6.8
0%
Jul 11External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections…
CVE-2024-23485
C6
Controller 6000 and Controller 7000
Gallagher
4.6
0%
Jul 11Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7000 can lead to secured door locks…
CVE-2024-22383
C7
Controller 7000
Gallagher
6.2
0%
Mar 5Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under…
CVE-2024-21838
CC
Command Centre Server
Gallagher
5.4
0%
Mar 5Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails…
CVE-2024-21815
CC
Command Centre Server
Gallagher
6.5
0%
Mar 5Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users
CVE-2023-46686
CC
Command Centre Diagnostics Service
Gallagher
7.1
1%
Dec 18A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure…
CVE-2023-41967
C6
Controller 6000
Gallagher
4.6
0%
Dec 18Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic…
CVE-2023-24590
C6
Controller 6000
Gallagher
8.8
1%
Dec 18A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to…
CVE-2023-23584
CC
Command Centre Server
Gallagher
4.3
1%
Dec 18An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would not otherwise be…
CVE-2023-23576
CC
Command Centre Server
Gallagher
4.3
0%
Dec 18Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when…
CVE-2023-23570
CC
Command Centre
Gallagher
8.1
1%
Dec 18Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior
CVE-2023-22439
C6
Controller 6000/ Controller 7000
Gallagher
4.3
1%
Dec 18Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can be used to perform a Denial of Service…
CVE-2023-6355
C7
Controller 7000
Gallagher
6.8
0%
Dec 18Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechanisms to enable local debug
CVE-2023-23568
CC
Command Centre
Gallagher
5.4
0%
Jul 25Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields
CVE-2023-22363
CC
Command Centre
Gallagher
7.5
1%
Jul 24Access Zone stack overflow
CVE-2023-25074
CC
Command Centre
Gallagher
5.4
0%
Jul 24Competency access levels not enforced in the server
CVE-2023-22428
CC
Command Centre
Gallagher
6.5
0%
Jul 24Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage
CVE-2023-24584
C6
Controller 6000
Gallagher
9.8
0%
Jun 1Controller 6000 buffer overflow via upload feature in web interface
CVE-2022-26348
CC
Command Centre
Gallagher
5.5
0%
Jul 6Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server
CVE-2022-26078
GC
Gallagher Controller 6000
Gallagher
7.5
1%
Jul 6Gallagher Controller 6000 is vulnerable to a Denial of Service attack via conflicting ARP packets with a duplicate IP address
CVE-2021-23197
CC
Command Centre
Gallagher
7.8
0%
Nov 18Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service
CVE-2021-23193
CC
Command Centre
Gallagher
6.5
1%
Nov 18Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators to retrieve sensitive information from…
CVE-2021-23167
CC
Command Centre
Gallagher
6.8
0%
Nov 18Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Command Centre Server
CVE-2021-23162
CC
Command Centre Mobile Connect
Gallagher
8.1
0%
Nov 18Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server
CVE-2021-23155
CC
Command Centre Mobile Client
Gallagher
6.8
0%
Nov 18Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server
CVE-2021-23146
CC
Command Centre
Gallagher
7.5
1%
Nov 18An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification
CVE-2021-23230
CC
Command Centre
Gallagher
4.3
1%
Jun 11A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected
CVE-2021-23211
CC
Command Centre
Gallagher
4.4
0%
Jun 11Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key to be discoverable in server memory…
CVE-2021-23205
CC
Command Centre
Gallagher
8.1
1%
Jun 11Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers and other hardware items beyond their…
CVE-2021-23204
CC
Command Centre
Gallagher
6.5
1%
Jun 11Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be exposed to Command Centre Operators
CVE-2021-23182
CC
Command Centre
Gallagher
4.4
0%
Jun 11Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in server memory dumps
CVE-2021-23140
CC
Command Centre
Gallagher
8.8
1%
Jun 11Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator