Gallagher Command Centre CVE-2025-41402
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as privileged operator
-
ExploitEnter invalid competency data in client
-
ExecutionClient-side-only check bypasses server validation
-
ImpactExpired competencies accepted as valid
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | Requires an authenticated, privileged operator account on the Command Centre Server; exploitation consists of that operator submitting invalid competency data via the client, which the server fails to re-validate because the expiry/competency enforcement is only applied client-side (CWE-602). Affected: Command Centre Server 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), and all 9.00 and earlier. Limiting factors: no remote unauthenticated path (local/operator access per AV:L/PR:L), impact is confined to data integrity of competency/expiry enforcement (I:H, C:N, A:N), and the actor must already hold operator privileges - effectively bounding this to insider misuse or operator error rather than external compromise. |
| Impact | This is a genuinely lower-tier issue that signals align on. The CVSS base score is 5.5 (medium) and the vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) describes a local, low-complexity attack that nonetheless requires existing privileges (PR:L) - the description reinforces this, naming a 'privileged operator' as the actor. The impact is integrity-only (I:H): invalid competency data bypasses expiry checks, with no confidentiality or availability loss. EPSS is very low at 0.14% (3rd percentile), it is NOT in CISA KEV, and no public exploit code was identified, so there is no evidence of opportunistic or widespread exploitation. The signals are consistent rather than conflicting: a privilege-gated, local, integrity-only flaw with near-zero exploitation probability. This is fundamentally an insider/trusted-operator abuse (or operator-error-enabling) scenario in a physical access-control product, not an externally scalable threat. Verify-with-vendor note: the description says 'privileged operator,' which could justify PR:H rather than the vendor's PR:L - the distinction matters because it would further lower the realistic attacker pool to already-elevated staff. |
| Exploit ScenarioDerived | A privileged operator of the Command Centre Server enters invalid competency data through the client, where the enforcement/validation that should occur server-side is only applied client-side (CWE-602), allowing expiry checks on competencies (e.g. required certifications for area access) to be bypassed. Because access requires an authenticated operator and local interaction, the realistic actor is a malicious or negligent insider rather than a remote attacker. No public exploit code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated privileged operators can bypass competency and expiry enforcement in Gallagher Command Centre Server because the validation is performed only in the client and never re-verified server-side (CWE-602), allowing invalid competency data to be written into the system. Affected builds are Command Centre Server 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), and all versions of 9.00 and earlier. The impact is confined to data integrity (I:H, C:N, A:N) with no confidentiality or availability effect, exploitation requires an already-privileged operator account on the server, no public exploit code has been identified at time of analysis, EPSS is 0.14% (3rd percentile), and the issue is not in CISA KEV - so practical risk is bounded to insider misuse or operator error rather than external compromise.
RemediationAI
Vendor-released patch: upgrade Command Centre Server to vEL9.30.2482 (MR2) for the 9.30 line, vEL9.20.2819 (MR4) for the 9.20 line, or vEL9.10.3672 (MR7) for the 9.10 line as documented at https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-41402. For sites still on 9.00 or earlier, no vendor-released patch was identified at time of analysis, so those installations should be treated as unfixed and migrated to a supported maintenance release. Where immediate upgrade is not possible, compensating controls should target the prerequisite operator privilege and the abused data field: restrict who holds competency-management or operator-privilege grants in Command Centre (trade-off: may reduce operational flexibility for site administrators), audit and periodically re-verify competency and expiry records against source HR/training data, and alert on competency values that have no matching server-side authorization (trade-off: adds manual review overhead and can generate false positives during legitimate bulk updates). Because the root cause is missing server-side re-validation, no purely network-based workaround - such as blocking a port or endpoint - removes the exposure; the fix must come from the patched build or from removing the privileged access that the exploit depends on. The provided tag 'Authentication Bypass' should be read in that context: this is a bypass of a client-side expiry/competency gate by an already-authenticated privileged operator, not an unauthenticated network authentication bypass.
Affected ProductsAI
Command Centre Server 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), and 9.10 prior to vEL9.10.3672 (MR7) are affected, as are all versions of 9.00 and earlier; the vendor states that 9.00 and prior are unfixed. No CPE identifiers were provided in the source data, so the version ranges in the Gallagher advisory (https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-41402) are the authoritative scope reference, and deployments should be confirmed against their installed build numbers rather than product family alone.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-602 (Client-Side Enforcement of Server-Side Security) describes a trust-boundary failure in which a security decision - here, whether competency data is valid and unexpired - is made by the client component, which is under the control of the operator, while the server accepts the client's conclusion without independently re-evaluating it. Command Centre is Gallagher's physical security and access management platform, and competency records govern whether an operator or credential holder is currently qualified or within a valid expiry window for a given task, area, or access right. Because the expiry/competency check is never re-run against the authoritative server-side record, a privileged operator can supply crafted or stale competency data and have it persisted, effectively extending or fabricating approvals that should have lapsed. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) confirms the attacker must already be a high-privileged, authenticated operator with local/operator-level reach to the Command Centre Server, that no user interaction is required, and that the only confirmed impact is integrity of competency/expiry data. The vendor-classified CWE aligns with the observed behavior: the server treats a client-side gate as authoritative rather than enforcing the constraint at the data layer. No CPE strings were supplied with this record, so affected scope is taken from the vendor advisory version ranges.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
A 'privileged operator' must be authenticated with elevated rights (PR:H) acting locally through the client (AV:L); impact is integrity-only (I:H) as expiry checks are bypassed, with no C or A effect.
Primary rating from Vendor (gallagher).
CVSS VectorVendor: gallagher
DescriptionCVE.org
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks.
This issue affects Command Centre Server:
9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB