Gallagher Command Centre Server log file

Summaryinfo

A vulnerability was found in Gallagher Command Centre Server, Active Directory Sync, Cardholder Sync Utility, Diagnostics Service, Elevator Service, Encoding Kiosk Application, Entra ID Sync, Event Sync Utility, Event Logger, Middleware Framework, Nexudus Integration, Okta Sync, Papercut Interface Integration and SIP Integration. It has been classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in log file. This vulnerability is known as CVE-2026-25193. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Gallagher Command Centre Server, Active Directory Sync, Cardholder Sync Utility, Diagnostics Service, Elevator Service, Encoding Kiosk Application, Entra ID Sync, Event Sync Utility, Event Logger, Middleware Framework, Nexudus Integration, Okta Sync, Papercut Interface Integration and SIP Integration. This affects an unknown code block. The manipulation with an unknown input leads to a log file vulnerability. CWE is classifying the issue as CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. This is going to have an impact on confidentiality. The summary by CVE is:

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

It is possible to read the advisory at security.gallagher.com. This vulnerability is uniquely identified as CVE-2026-25193 since 03/02/2026. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31636). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Middleware

Vendor

• Gallagher

Name

• Active Directory Sync
• Cardholder Sync Utility
• Command Centre Server
• Diagnostics Service
• Elevator Service
• Encoding Kiosk Application
• Entra ID Sync
• Event Logger
• Event Sync Utility
• Middleware Framework
• Nexudus Integration
• Okta Sync
• Papercut Interface Integration
• SIP Integration

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion