CVE-2021-23146 Auth bypass in Command Center

What is CVE-2021-23146?

CVE-2021-23146 is a high-severity authentication bypass vulnerability in Gallagher Command Center, published on 18 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions prior to 8.30.1359 (MR3); 8.20 versions prior to 8.20.1259 (MR5); 8.10 versions prior to 8.10.1284 (MR7); version 8.00 and prior versions.

Weakness: CWE-697, CWE-1023

Which versions are affected by CVE-2021-23146?

It affects 1 product.

Products include Gallagher Command Centre.

How do I fix CVE-2021-23146?

No fix has been published for CVE-2021-23146 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-23146 being exploited?

There is no known exploitation of CVE-2021-23146 in the wild and no public exploit code.

Other vulnerabilities in Gallagher Command Center

• CVE-2021-23140 Missing authorization in Command Centre Critical 9.9
• CVE-2021-23230 SQL injection in Command Centre Critical 9.9
• CVE-2020-16096 Missing authorization in Command Centre Critical 9.9
• CVE-2020-16098 Information disclosure in Command Centre Critical 9.8
• CVE-2019-15294 Information disclosure in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-356x-mxw5-7m2m.