Gallagher Command Centre CVE-2025-47699

Requires (1) a valid authenticated Gallagher Command Centre Server operator account, even one with only limited site permissions, and (2) a deployment that has the Gallagher Morpho integration configured with local Morpho biometric devices; environments without the Morpho integration are not exposed. The vulnerability lets that operator exceed their authorized site scope to make critical changes to Morpho devices. Limiting factors: exploitation depends on prior authentication (insider or compromised operator credentials), so it is not anonymously reachable, and it is confined to installations running the Morpho integration on the affected versions (8.90 and prior, and 9.00/9.10/9.20/9.30 below the listed MR fix builds).

Despite a CVSS base score of 9.9 (Critical), the real-world risk profile is more nuanced. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H shows the score is driven largely by the scope change (S:C) - the flaw lets a Command Centre operator affect downstream Morpho biometric devices - combined with full C/I/A impact. Crucially, PR:L means exploitation is NOT unauthenticated: it requires a valid operator account that holds only limited site permissions, so the threat model is a malicious insider or a compromised/low-trust operator account rather than an anonymous internet attacker. Corroborating signals point to low immediate urgency: EPSS is only 0.34% (25th percentile), there is no CISA KEV listing, and no public proof-of-concept was identified. The signals are therefore consistent rather than conflicting - a high structural severity but low observed exploitation likelihood. One descriptive tension to verify with the vendor: CWE-497 and the 'Information Disclosure' tag frame this as sensitive-information exposure, yet the description's stated impact is that the operator can 'make critical changes to local Morpho devices,' which is an integrity/privilege-escalation outcome; the CVSS I:H reflects the latter. This is a genuine priority for organizations running the Gallagher Morpho integration (patch per the vendor advisory), but it is not an internet-wide, mass-exploitable emergency.

A low-privilege Gallagher Command Centre operator - or an attacker who has phished/compromised such an operator's credentials - logs into the Command Centre Server over the network and abuses the Morpho integration to push critical configuration changes to local Morpho biometric readers beyond their authorized site scope, potentially weakening or reconfiguring physical access control. No special user interaction or elevated privileges are needed once the operator session exists; no public exploit code was identified at time of analysis.