Critical · published March 5, 2024
🔥 Third-party DVR integrations in Gallagher Command Centre could expose sensitive credentials to unprivileged users! Think of it as a restaurant where customers can sneak into the kitchen and access the chef's secret recipes — that's how easy it is for unauthorized users to access credential storage! This vulnerability allows authenticated but low-privileged users to access sensitive credentials, potentially leading to unauthorized control over DVR systems. An attacker could exploit this gap to manipulate security settings or even watch the surveillance feed, creating a nightmare scenario for security management!
Think of it as a restaurant where customers can sneak into the kitchen and access the chef's secret recipes — that's how easy it is for unauthorized users to access credential storage! The issue arises from insufficient protection of credentials for third-party DVR integrations, allowing access to these credentials for users who shouldn't have them. This vulnerability affects multiple versions of Gallagher Command Centre, specifically versions prior to vEL9.00.1774, vEL8.90.1751, vEL8.80.1526, and vEL8.70.2526, as well as all versions of 8.60 and earlier.
This vulnerability allows authenticated but low-privileged users to access sensitive credentials, potentially leading to unauthorized control over DVR systems. An attacker could exploit this gap to manipulate security settings or even watch the surveillance feed, creating a nightmare scenario for security management! To mitigate this vulnerability, immediately upgrade to Gallagher Command Centre version vEL9.00.1774 or later, vEL8.90.1751 or later, vEL8.80.1526 or later, or vEL8.70.2526 or later. Review user permissions to ensure only privileged users have access to sensitive credentials, and regularly audit your security settings to strengthen your defenses. You've got this! By following these steps, you're not just fixing a vulnerability; you're bolstering your security fortress! 🛡️