SQL Injection Vulnerability in Gallagher Command Centre
CVE-2021-23230

9.9CRITICAL

Key Information:

Vendor

Gallagher

Status
Command Centre
Vendor
CVE Published:
11 June 2021

What is CVE-2021-23230?

A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows remote, unprivileged operators to manipulate Command Centre databases without detection. This security flaw affects various versions of Gallagher Command Centre, making it vital for users to ensure they are running updated software to mitigate potential risks.

Affected Version(s)

Command Centre <= 8.00

Command Centre 8.40 < 8.40.1888 (MR3)

Command Centre 8.30 < 8.30.1359 (MR3)

References

https://security.gallagher.com/Security-Advisories/CVE-20...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-23230 : SQL Injection Vulnerability in Gallagher Command Centre