Command Centre Server CVE-2025-35981

Requires an existing authenticated account on the Command Centre Server holding at least low-level Operator privileges (PR:L); it is NOT remotely exploitable by anonymous actors. The limiting factors are significant: the attacker must already be a trusted, provisioned Operator inside the physical-access-control management system, and exploitation only reveals limited cardholder personal data - no write access, configuration change, or availability impact. Affected builds are specifically 9.30.1874 (MR1), 9.20.2337 (MR3), and 9.10.3194 (MR6); environments on other/patched builds are not affected. No special non-default feature toggle is named in the description - the over-broad data visibility occurs through normal cardholder viewing by an under-privileged operator.

This is a low-to-moderate priority issue, not a high-urgency threat. The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a confidentiality-only authorization flaw: a user who is ALREADY an authenticated, privileged Operator can view limited cardholder personal data beyond their intended permission scope. There is no integrity or availability impact and no privilege escalation. The EPSS score is very low (0.13%, 3rd percentile), consistent with the absence of any public exploit and the fact that exploitation requires an existing trusted insider account rather than remote reach. This CVE is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation - no public exploit identified at time of analysis. Note one conflict worth flagging: the input Tag labels this 'Authentication Bypass,' but the description and CWE-359 (Exposure of Private Personal Information) describe an AUTHORIZATION/information-disclosure problem affecting an already-authenticated operator - it is not an authentication bypass. Also, the description says 'limited personal data,' which arguably supports a Confidentiality impact of Low rather than the vendor's High; this is an honest point of disagreement, not a confirmed error. Overall: real but modest insider-trust confidentiality risk, appropriately prioritized below internet-facing or RCE issues.

A low-privileged but legitimate Command Centre Operator - for example a guard-desk or departmental operator without HR/security-admin rights - navigates to a Cardholder record and is able to view limited personal details (PII) that their role should not expose. No public exploit code is required or known; the flaw is triggered through normal application use by an already-authenticated insider. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, exploitation is simple for anyone with any operator-level access.