Gallagher Command Centre CVE-2025-48428

Requires an authenticated user who already holds high-privilege access to the Gallagher Command Centre Server, and the specific Morpho (biometric) integration must be configured and in use, since the exploit hinges on exporting a signing key 'while in use' by that integration. Exploitation is further limited by the local attack vector (AV:L) - the actor must operate against the Command Centre Server itself, not over the network - and by the PR:H requirement, effectively restricting this to trusted administrators or an attacker who has already obtained an administrative foothold. Sites not using the Morpho integration are not exposed.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N) makes the real constraints clear: exploitation requires local access to the Command Centre Server AND high privileges (PR:H) - i.e. an already-trusted administrative user. This is fundamentally a privilege/trust-abuse scenario, not a remotely reachable flaw. The EPSS score of 0.10% (1st percentile) is consistent with this, indicating negligible likelihood of opportunistic exploitation in the wild. The CVE is NOT on CISA KEV and there is no public exploit code, so there is no evidence of active exploitation. The high C:H/I:H/A:H impact rating reflects the severity of consequences IF an authorized insider abuses it (signing-key exposure enabling counterfeit device deployment), but the PR:H + AV:L gating means this is a classic high-impact/low-likelihood insider or post-compromise issue rather than an urgent perimeter threat. Bottom line: patch on normal maintenance cadence; it is not a drop-everything emergency, and the elevated CVSS is driven by impact, not by ease of exploitation.

An authenticated operator with high-privilege access to the Gallagher Command Centre Server uses the Morpho integration functionality to export a signing key that is actively in use. With that key, the attacker enrolls or deploys a compromised or counterfeit biometric/access device that the site trusts as legitimate, undermining physical access control. No public proof-of-concept exists, and the local access plus high-privilege requirement limits this to insiders or an attacker who has already compromised an administrative session.