PT-2021-15411 · Gallagher · Gallagher Command Centre

Published 2021-06-11 · Updated 2021-06-22 · CVE-2021-23230

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions prior to 8.40.1888 (MR3) Gallagher Command Centre versions prior to 8.30.1359 (MR3) Gallagher Command Centre versions prior to 8.20.1259 (MR5) Gallagher Command Centre versions prior to 8.10.1284 (MR7) Gallagher Command Centre version 8.00 and prior versions

Description A SQL Injection issue in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected.

Recommendations For versions prior to 8.40.1888 (MR3), update to version 8.40.1888 (MR3) or later. For versions prior to 8.30.1359 (MR3), update to version 8.30.1359 (MR3) or later. For versions prior to 8.20.1259 (MR5), update to version 8.20.1259 (MR5) or later. For versions prior to 8.10.1284 (MR7), update to version 8.10.1284 (MR7) or later. For version 8.00 and prior versions, update to a version later than 8.00.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-23230

Affected Products

Gallagher Command Centre

References · 3

• https://osv.dev/vulnerability/CVE-2021-23230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23230 · Security Note
• https://security.gallagher.com/Security-Advisories/CVE-2021-23230 · Vendor Advisory