Medium severity · published Mar 3, 2026
CVE-2025-47147
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile…
5.7
CVSS
0.1%
EPSS
No
On KEV
Description
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited duration.
This issue affects Command Centre Mobile Client versions prior to 9.40.123.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 0% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Command Centre Mobile Client · Gallagher
9.40 before 9.40.123 · source: vendor
CC
Command Centre Mobile · Gallagher
before 9.40.123; before 9.40.123 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47147
Vendor Advisory
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-47147
More from Command Centre Mobile Client
6.8
CVE-2021-23155
Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server