Command Centre CVE-2026-27790

Exploitation requires an account that is both authenticated to Gallagher Command Centre and explicitly authorized to interact with T20 Reader devices - the CVSS PR:H metric confirms high-privilege access is mandatory. The triggering condition is sending 'specific requests' to the T20 Reader component; the exact request format is not publicly disclosed. The vulnerability does NOT affect unauthenticated network paths, low-privilege users, or deployments where no T20 Readers are deployed. Limiting factors include: the high privilege barrier (only authorized operators), the temporary and self-recovering nature of the DoS (reader restarts rather than permanently failing), and the requirement that the attacker already have a valid, authorized Command Centre operator account.

The aggregate risk signal here is uniformly low. CVSS 2.7 reflects PR:H (high privileges required) and A:L (limited, temporary availability impact - a reader restart rather than sustained outage), with C:N and I:N confirming no data exposure or integrity risk. EPSS data is not provided but would be expected to be very low given the high authentication barrier and niche product footprint. No KEV listing and no public POC further confirm this is not being actively weaponized. The only realistic threat actor is a disgruntled or compromised operator with legitimate Command Centre credentials. The absence of conflicting signals between the CVSS vector and the description is notable - PR:H aligns precisely with the stated 'authenticated and authorized operator' requirement, giving high confidence in the score accuracy. This is not a reprioritization candidate over lower-scored but more exploitable vulnerabilities.

An operator with valid Command Centre credentials and authorization to manage T20 Readers sends a specifically crafted request to the reader subsystem. The request triggers an unhandled exception in the T20 Reader process, causing it to terminate and restart, briefly interrupting physical access control operations at any door or gate using that reader. No exploit code is publicly available; the attack requires intentional crafting of malformed requests by someone who understands the reader protocol.