High severity · published Sep 11, 2024
CVE-2024-43690
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE)
8.0
CVSS
0.6%
EPSS
No
On KEV
Description
Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).
This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Centre Server · Gallagher
through 8.70; 9.10 before vEL9.10.1530(MR2); 9.00 before vEL9.00.2168 (MR4); 8.90 before vEL8.90.2155 (MR5); 8.80 before vEL8.80.1938 (MR6) · source: vendor
CC
Command Centre · Gallagher
through 8.70; 9.10 through 9.10.1530(mr2); 9.00 through 9.00.2168(mr4); 8.90 through 8.90.2155(mr5); 8.80 through 8.80.1938(mr6) · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-43690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-43690
security.gallagher.com
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43690
More from Command Centre Server
9.9
CVE-2025-47699
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site…
8.7
CVE-2024-41724
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server
8.6
CVE-2026-25193
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only…
8.5
CVE-2024-42407
Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security…
6.7
CVE-2025-48428
Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a…