CVE-2025-35983 Security feature bypass in Controller 7000
An unprivileged attacker can cause denial of service or perform privileged overrides during initial configuration of the Controller 7000.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-35983?
CVE-2025-35983 is a medium-severity vulnerability in Gallagher Controller 7000, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected.
This issue affects Controller 7000:
9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)).
Weakness: CWE-295
Which versions are affected by CVE-2025-35983?
How do I fix CVE-2025-35983?
No fix has been published for CVE-2025-35983 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-35983 being exploited?
There is no known exploitation of CVE-2025-35983 in the wild and no public exploit code.
Sources
Also known as GHSA-63vm-7c93-254f.