CVE-2021-23155
📋 TL;DR
This vulnerability allows attackers to perform man-in-the-middle attacks against Gallagher Command Centre Mobile Client for Android by exploiting improper certificate chain validation. Attackers can impersonate legitimate servers to intercept or manipulate communications. This affects Android mobile clients running versions 8.50 and earlier, and 8.60 versions prior to 8.60.065.
💻 Affected Systems
- Gallagher Command Centre Mobile Client for Android
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of mobile client communications, allowing attackers to intercept sensitive security system data, issue unauthorized commands to physical security systems, or gain unauthorized access to protected facilities.
Likely Case
Interception of mobile client communications, potentially exposing sensitive security system information and allowing attackers to monitor security operations.
If Mitigated
Limited impact with proper network segmentation and certificate pinning, though risk remains if mobile clients connect to untrusted networks.
🎯 Exploit Status
Exploitation requires man-in-the-middle position on the network path between mobile client and server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.60.065 or later
Vendor Advisory: https://security.gallagher.com/Security-Advisories/CVE-2021-23155
Restart Required: Yes
Instructions:
1. Update Gallagher Command Centre Mobile Client for Android to version 8.60.065 or later. 2. Restart the application after update. 3. Verify the update was successful by checking the app version.
🔧 Temporary Workarounds
Network Segmentation
allRestrict mobile client access to trusted networks only, preventing connections from untrusted networks where MITM attacks are more likely.
VPN Enforcement
allRequire all mobile clients to connect through a corporate VPN with certificate validation.
🧯 If You Can't Patch
- Restrict mobile client usage to trusted, controlled networks only
- Implement network monitoring for unusual certificate validation failures
🔍 How to Verify
Check if Vulnerable:
Check the app version in Android settings > Apps > Gallagher Command Centre Mobile Client > App infoCheck Version:
Not applicable - check through Android app settingsVerify Fix Applied:
Verify app version is 8.60.065 or later and test certificate validation with a MITM proxy tool📡 Detection & Monitoring
Log Indicators:
- Certificate validation errors in mobile client logs
- Unexpected certificate authorities in TLS handshakes
Network Indicators:
- Unusual TLS certificate chains in mobile client traffic
- MITM proxy detection in network traffic
SIEM Query:
source="mobile_client" AND (event_type="certificate_error" OR event_type="tls_handshake_failure")