Critical · published October 23, 2025
🔥 An authenticated operator with limited permissions can pull off a shocking heist by making critical changes to local Morpho devices! This situation is like a hotel staff member having access to every room key; they may only need to check in on a few guests, but with the wrong intent, they can wander into any room and cause chaos. If exploited, this vulnerability could allow an attacker to manipulate critical settings on Morpho devices, potentially leading to unauthorized access or even system failure. Imagine the havoc that could ensue if someone could remotely tamper with the core functions of security devices designed to keep your space safe!
This situation is like a hotel staff member having access to every room key; they may only need to check in on a few guests, but with the wrong intent, they can wander into any room and cause chaos. CVE-2025-47699 allows an authenticated user with limited site permissions to access sensitive system information, enabling them to make unauthorized changes to local Morpho devices. This exposure is due to a lack of proper access control in the Gallagher Morpho integration.
If exploited, this vulnerability could allow an attacker to manipulate critical settings on Morpho devices, potentially leading to unauthorized access or even system failure. Imagine the havoc that could ensue if someone could remotely tamper with the core functions of security devices designed to keep your space safe! Upgrade your Command Centre Server to version vEL9.30.2482 (MR2) or later if you're on 9.30, vEL9.20.2819 (MR4) or later for 9.20, vEL9.10.3672 (MR7) or later for 9.10, and vEL9.00.3831 (MR8) or later for 9.00. Don't forget to review your user permissions and limit access to essential personnel only! You've got this! With these steps, you'll bolster your defenses and keep your systems safe! 🛡️