CVE Vulnerabilities

CVE-2024-21815

Insufficiently Protected Credentials

Published: Mar 05, 2024 | Modified: Feb 10, 2025
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users.

This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6),  all version of 8.60 and prior.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name Vendor Start Version End Version
Command_centre Gallagher * 8.60 (including)
Command_centre Gallagher 8.70 (including) 8.70.2526 (excluding)
Command_centre Gallagher 8.80 (including) 8.80.1526 (excluding)
Command_centre Gallagher 8.90 (including) 8.90.1751 (excluding)
Command_centre Gallagher 9.00 (including) 9.00.1774 (excluding)

Potential Mitigations

References