CVE-2021-23167 Weak cryptography in Command Centre

What is CVE-2021-23167?

CVE-2021-23167 is a high-severity vulnerability in Gallagher Command Centre, published on 18 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3); 8.40 versions prior to 8.40.2063 (MR4); 8.30 versions prior to 8.30.1454 (MR4) ; version 8.20 and prior versions.

Weakness: CWE-295

Which versions are affected by CVE-2021-23167?

It affects 1 product.

Products include Gallagher Command Centre.

How do I fix CVE-2021-23167?

No fix has been published for CVE-2021-23167 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-23167 being exploited?

There is no known exploitation of CVE-2021-23167 in the wild and no public exploit code.

Other vulnerabilities in Gallagher Command Centre

• CVE-2021-23140 Missing authorization in Command Centre Critical 9.9
• CVE-2021-23230 SQL injection in Command Centre Critical 9.9
• CVE-2020-16096 Missing authorization in Command Centre Critical 9.9
• CVE-2020-16098 Information disclosure in Command Centre Critical 9.8
• CVE-2019-15294 Information disclosure in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-36x7-v6h4-4q78.