EUVD-2026-42002
GHSA-2c5j-956x-xmg8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Network-accessible diagnostic interface requires authenticated high-privilege operator; only transient availability impact, no confidentiality or integrity effect.
Primary rating from Vendor (Gallagher).
CVSS VectorVendor: Gallagher
Lifecycle Timeline
1DescriptionCVE.org
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected:
- 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))
- 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3))
- 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))
- 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))
- all versions of 9.10 and prior.
AnalysisAI
Uncaught Exception in the Gallagher Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to force a controller restart by sending specific crafted requests, causing a temporary denial of service. Affected versions span Gallagher Command Centre 9.20 through 9.50 (pre-patch) and all versions of 9.10 and earlier. No public exploit code exists and no active exploitation has been identified; the high privilege requirement substantially limits real-world attack surface to insider or compromised-operator scenarios.
Technical ContextAI
The affected hardware - Gallagher Controller 6000 and Controller 7000 - are physical access control system (PACS) controllers managed through Gallagher Command Centre software. CPE cpe:2.3:a:gallagher:controller_7000_and_6000 confirms these are application-layer components. The diagnostic web interface exposed on these controllers fails to handle certain exceptional conditions (CWE-248: Uncaught Exception), meaning the software does not implement adequate exception handlers for specific request patterns. When such a request is processed, the unhandled exception propagates and causes the controller process to terminate and restart. Because these controllers gate physical access (doors, turnstiles, alarms), even a brief restart can temporarily disrupt physical access enforcement, though the restart is not persistent and service resumes automatically.
RemediationAI
The primary remediation is to upgrade Command Centre to a patched maintenance release: 9.50.1587 (MR1) containing vCR9.50.260616a, 9.40.3130 (MR3) containing vCR9.40.260616a, 9.30.3983 (MR5) containing vCR9.30.260616a, or 9.20.4349 (MR7) containing vCR9.20.260616a, as applicable to the deployed branch. Full advisory and download details are available at https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27844. For installations on Command Centre 9.10 or earlier, no patch has been identified - organizations on these branches should prioritize upgrading to a supported release. As a compensating control, administrators should audit and minimize the number of operator accounts with access to the diagnostic web interface, applying the principle of least privilege to reduce insider-misuse risk. Network-level segmentation of the controller management network from general user access can additionally reduce the attack surface, though it does not eliminate risk from authorized operator accounts already on that segment.
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today