Severity: High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
Components affected: Gallagher Mobile Connect for Android
Version of Command Centre affected: All versions below 15.04.040
Reported by: Gallagher
Active exploitation of vulnerability*: No
Description of vulnerability: Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server.
This issue affects: All versions below 15.04.040
Maintenance releases are now available for: 15.04.040
Important notes: If running against a Command Centre Server running Command Centre v8.40 or later the severity is reduced to High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
*This indicates whether Gallagher are aware of this being actively exploited against customer sites at the time of publication.
Stay up to date with Gallagher
Get the latest Gallagher news, updates, and event information delivered straight to your inbox.