CVE-2021-23162 in Command Centre Mobile Connect
Summary
by MITRE • 11/18/2021
Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Connect for Android 15 versions prior to 15.04.040; version 14 and prior versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/22/2021
The vulnerability described in CVE-2021-23162 represents a critical security flaw in the Mobile Connect component of Gallagher Command Centre systems, specifically affecting Android mobile applications. This issue stems from inadequate validation of cloud certificate chains during the secure communication establishment process between mobile devices and the legitimate Command Centre Server. The improper certificate validation mechanism creates a pathway for malicious actors to execute man-in-the-middle attacks by presenting forged certificates that appear legitimate to the mobile application.
The technical flaw manifests in the certificate chain validation process where the Mobile Connect application fails to properly verify the authenticity and integrity of SSL/TLS certificates presented by the cloud server. This weakness allows attackers to intercept communications between the mobile device and the Command Centre Server by presenting counterfeit certificates that have been signed by a trusted Certificate Authority but are not actually associated with the legitimate server. The vulnerability specifically impacts versions 15.04.040 and earlier of the Mobile Connect application, as well as all versions 14 and prior, indicating a long-standing issue that was not adequately addressed in the software development lifecycle.
From an operational perspective, this vulnerability exposes organizations using Gallagher Command Centre systems to significant security risks including unauthorized access to sensitive facility management data, potential compromise of access control systems, and the ability for attackers to manipulate or monitor communications between mobile users and the central Command Centre. The man-in-the-middle attack capability allows adversaries to eavesdrop on communications, inject malicious commands, or even redirect users to fraudulent server endpoints, potentially leading to complete system compromise and unauthorized physical access control.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the patched version 15.04.040 or later of the Mobile Connect application, conducting thorough security assessments of their mobile infrastructure, and implementing additional network monitoring to detect potential interception attempts. The vulnerability aligns with CWE-295, which addresses improper certificate validation, and maps to ATT&CK technique T1573.002 for "Reconnaissance: Network Sniffing" and T1071.004 for "Application Layer Protocol: DNS" which could be leveraged by attackers to exploit this weakness. Security teams should also consider implementing certificate pinning mechanisms and enhanced network segmentation to reduce the attack surface and prevent successful exploitation of this certificate validation flaw.