Vendor
Gallagher
70 known vulnerabilities.
Gallagher at a glance
- Last 12 months
- 10
- Critical · all time
- 7
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 3 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 1 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 3 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 3 | 0 |
| Oct 2025 | 5 | 1 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 3 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 2 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 2 | 0 |
Products
Command Centre 26
Command Centre Server 16
Controller 6000 and Controller 7000 7
Controller 6000 3
Controller 7000 3
Milestone Integration Plugin 1
Controller 7000 and 6000 1
Active Directory Sync 1
Cardholder Sync Utility 1
Diagnostics Service 1
Elevator Service 1
Encoding Kiosk Application 1
Entra ID Sync 1
Event Sync Utility 1
Event Logger 1
Middleware Framework 1
Nexudus Integration 1
Okta Sync 1
Papercut Interface Integration 1
SIP Integration 1
Controller 6000/ Controller 7000 1
T-Series Readers 1
Command Centre Mobile Client for Android 1
Command Centre Diagnostics Service 1
Command Centre Mobile Connect for Android 1
Command Center 1
Gallagher Controller 6000 1
T-20 Readers 1
HBUS Devices 1
Command Centre Mobile Client 1
High Sec End of Line Module 1
NxWitness VMS and Hanwha VMS Integrations 1
T21 Reader 1
70 results · Feed
-
Low 2.7
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticate…
-
Low 2.7
Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by…
-
Medium 5.3
An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator…
-
High 8.1
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Serv…
-
Medium 5.6
Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher…
-
Low 2.5
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limite…
-
Medium 5.7
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow…
-
Low 2.4
Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical acces…
-
Medium 5.7
Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sop…
-
Medium 5.7
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to ext…
-
Medium 5.5
Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Com…
-
Medium 6.7
Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated u…
-
Critical 9.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integratio…
-
Medium 5.5
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to …
-
Medium 5.5
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privi…
-
Medium 5.6
A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high …
-
Medium 4.3
Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with…
-
Medium 6.5
Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged att…
-
High 8.7
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoo…
-
High 7.2
Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated m…
-
High 8.5
Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature co…
-
Medium 4.6
Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms coul…
-
High 8.0
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may all…
-
Medium 4.6
Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows…
-
Medium 6.5
Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interfac…
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnos…
-
Medium 6.3
External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local…
-
Low 3.3
Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacke…
-
Medium 6.8
External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface a…
-
Medium 4.6
Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the …
-
Medium 6.2
Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Seri…
-
Medium 6.8
Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Cent…
-
Critical 9.1
Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are access…
-
Medium 5.5
A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallaghe…
-
Low 2.4
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacke…
-
High 7.5
A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory,…
-
Medium 4.3
An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to …
-
Medium 4.3
Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site …
-
Medium 5.4
Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid con…
-
Low 3.1
Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web in…