CVE-2021-23140CWE-285

Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator

Critical · published June 11, 2021

CVSS v3.1
9.9
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

🚨 A rogue operator could easily tweak command line macros without breaking a sweat. This improper authorization vulnerability in Gallagher Command Centre is a real wake-up call! 🔥 Imagine a hotel staff member who can change the room keys for guests at will, without any verification. This flaw allows unauthorized users to access and modify critical operational commands, just like mischievous staff altering guest access without permission. This is absolutely devastating! An attacker could manipulate server commands, potentially compromising security protocols, disrupting operations, and gaining unauthorized access to sensitive areas. The consequences could range from operational chaos to severe security breaches.

Put simply

Imagine a hotel staff member who can change the room keys for guests at will, without any verification. This flaw allows unauthorized users to access and modify critical operational commands, just like mischievous staff altering guest access without permission. The vulnerability arises from improper authorization checks, allowing unprivileged Command Centre Operators to alter command line macros. This can lead to unauthorized commands being executed, putting the entire system at risk.

What to do

This is absolutely devastating! An attacker could manipulate server commands, potentially compromising security protocols, disrupting operations, and gaining unauthorized access to sensitive areas. The consequences could range from operational chaos to severe security breaches. Immediate action is crucial! Patch your Gallagher Command Centre to versions 8.40.1888 (MR3), 8.30.1359 (MR3), 8.20.1259 (MR5), or upgrade from version 8.10. Review user permissions and ensure proper authorization mechanisms are in place. 🛡️ You've got this! Follow the steps, and you'll secure your system in no time. 🌟

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00853 · 57.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2021-06-11T15:46Z
EPSS history
Timeline
  • 11 JUN 15:46Z
    Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command Centre Operator
    cvelistv5