Middleware Framework
Monthly
Installer log files across 15 Gallagher Command Centre service components write Service Account credentials in plaintext to %programdata%\Gallagher\Command Centre during installation, enabling any local attacker with filesystem read access to harvest those credentials. Exploitation is gated by a non-default configuration - only deployments that replaced the default Network Service account with a custom Service Account are at risk - which substantially narrows the real-world attack surface. No public exploit code exists, EPSS sits at the 2nd percentile, and CISA SSVC classifies exploitation as 'none', but the downstream blast radius is significant: exposed credentials could authenticate an attacker into Active Directory, Entra ID, Okta, or physical-access control infrastructure.
Installer log files across 15 Gallagher Command Centre service components write Service Account credentials in plaintext to %programdata%\Gallagher\Command Centre during installation, enabling any local attacker with filesystem read access to harvest those credentials. Exploitation is gated by a non-default configuration - only deployments that replaced the default Network Service account with a custom Service Account are at risk - which substantially narrows the real-world attack surface. No public exploit code exists, EPSS sits at the 2nd percentile, and CISA SSVC classifies exploitation as 'none', but the downstream blast radius is significant: exposed credentials could authenticate an attacker into Active Directory, Entra ID, Okta, or physical-access control infrastructure.