CVE-2021-23140
📋 TL;DR
This vulnerability allows unauthorized Command Centre Operators to modify command line macros in Gallagher Command Centre Server, potentially executing arbitrary commands. It affects Gallagher Command Centre versions 8.10 and prior, 8.20 before 8.20.1259 (MR5), 8.30 before 8.30.1359 (MR3), and 8.40 before 8.40.1888 (MR3).
💻 Affected Systems
- Gallagher Command Centre Server
📦 What is this software?
Command Centre by Gallagher
Command Centre by Gallagher
Command Centre by Gallagher
Command Centre by Gallagher
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands with server privileges, potentially gaining full control over the physical security system.
Likely Case
Unauthorized operators gaining elevated privileges to modify system configurations, execute commands, or disrupt security operations.
If Mitigated
Limited impact if proper access controls and network segmentation are implemented, restricting unauthorized operator access.
🎯 Exploit Status
Requires operator-level access but no authentication bypass; exploitation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.40.1888 (MR3), 8.30.1359 (MR3), 8.20.1259 (MR5)
Vendor Advisory: https://security.gallagher.com/Security-Advisories/CVE-2021-23140
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Gallagher support portal. 2. Backup system configuration. 3. Apply patch following Gallagher installation guide. 4. Restart Command Centre Server services.
🔧 Temporary Workarounds
Restrict Operator Access
allLimit operator accounts to only trusted personnel and implement least privilege access controls.
Network Segmentation
allIsolate Command Centre Server from untrusted networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict access controls and audit all operator activities regularly.
- Segment the network to isolate Command Centre Server and monitor for suspicious macro modifications.
🔍 How to Verify
Check if Vulnerable:
Check Command Centre version in administration console or via version file in installation directory.Check Version:
Check 'Help > About' in Command Centre GUI or examine version.txt in installation folder.Verify Fix Applied:
Verify version is updated to patched version and test operator permissions for macro modification.📡 Detection & Monitoring
Log Indicators:
- Unauthorized macro modification attempts in Command Centre logs
- Unexpected command execution events
Network Indicators:
- Unusual network traffic from Command Centre Server to unexpected destinations
SIEM Query:
source="command_centre" AND (event="macro_modification" OR event="command_execution") AND user NOT IN authorized_operators