CVE-2021-23162

Severity: High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Components affected: Gallagher Mobile Connect for Android
Version of Command Centre affected: All versions below 15.04.040
Reported by: Gallagher
Active exploitation of vulnerability*: No
Description of vulnerability: Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server.
This issue affects:  All versions below 15.04.040
Maintenance releases are now available for: 15.04.040
Important notes: If running against a Command Centre Server running Command Centre v8.40 or later the severity is reduced to High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

*This indicates whether Gallagher are aware of this being actively exploited against customer sites at the time of publication.