CVE-2021-23155

Severity: Critical CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Components affected: Command Centre Mobile Client for Android
Version of Command Centre affected: All versions prior to 8.60.065
Reported by: Gallagher
Active exploitation of vulnerability*: No
Description of vulnerability: Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server.
Mitigation: Disable 125 kHz card technology.
This issue affects:  All versions prior to 8.60.065
Maintenance releases are now available for: 8.60.065

*This indicates whether Gallagher are aware of this being actively exploited against customer sites at the time of publication.