Command Centre Server CVE-2025-48430

Exploitation requires a valid, authenticated account on the Gallagher Command Centre Server that holds both 'Authorized' and 'Privileged' Operator rights - i.e., an existing trusted insider or a compromised privileged operator credential; it cannot be triggered by unauthenticated or low-privilege users. Per the CVSS vector the access is local (AV:L) with no user interaction and low attack complexity. Affected deployments are Command Centre Server 8.90 and all prior versions, 9.00 before vEL9.00.3831 (MR8), 9.10 before vEL9.10.3672 (MR7), 9.20 before vEL9.20.2819 (MR4), and 9.30 before vEL9.30.2482 (MR2); upgrading to the listed MR builds removes the condition. The requirement for privileged operator credentials is the primary limiting factor sharply reducing real-world risk.

This is a genuinely low-priority issue despite its MEDIUM CVSS 5.5 rating, and the signals are consistent rather than conflicting. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a local, authenticated availability-only impact: an attacker needs valid Operator credentials and privileged rights before anything can happen, and the only consequence is a server crash (C:N/I:N - no data exposure or integrity loss). EPSS reinforces this as low urgency at 0.12% (2nd percentile), and the vulnerability is NOT in CISA KEV with no public POC identified, so there is no evidence of exploitation. No SSVC decision data was supplied. One point to verify with the vendor: the vector asserts AV:L (local) while the description frames the actor as an 'Authorized and Privileged Operator,' who in Gallagher Command Centre deployments typically connects via an operator workstation client - if operator access is in fact network-reachable, the real attack vector may be AV:N rather than AV:L; this does not change the low real-world risk given the insider/privileged-access precondition. Net: a self-inflicted or malicious-insider denial-of-service by an already-trusted operator, not a remote mass-exploitation threat.

A disgruntled or compromised privileged operator account is used to issue a specific operation that triggers an uncaught exception in the Command Centre Server, crashing the physical-access-control backend and disrupting site security operations until the service is restarted. No public exploit code is known, and exploitation requires pre-existing authorized, privileged access rather than any remote unauthenticated foothold.