Skip to content
OpenAdvisories
Critical · 9.9 CVE-2025-47699 EUVD-2025-35649GHSA-3v3q-fq2w-23r5

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an aut…

Published Oct 23, 2025 · Updated Oct 23, 2025 · Assigned by Gallagher

Vendor: Gallagher Product: Command Centre Server

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices.

This issue affects Command Centre Server:

9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.

Affected products

VendorProductAffectedFixed
Gallagher Command Centre Server ≤ 8.90, 9.30 – < 9.30.2482 (MR2), 9.20 – < 9.20.2819 (MR4), 9.10 – < 9.10.3672 (MR7, 9.00 – < 9.00.3831 (MR8) 9.30.2482 (MR2)

References