Vulnerability · Published Nov 18, 2021 · Assigned by Gallagher
CVE-2021-23155
Critical 9.0
In plain English
A critical-severity security flaw in Command Centre Mobile Client for Android from Gallagher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)0.5%top 58.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Client for Android 8.60 versions prior to 8.60.065; version 8.50 and prior versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gallagher | Command Centre Mobile Client for Android | unspecified – through 8.508.60 – before 8.60.065 |
Weakness: CWE-296 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://security.gallagher.com/Security-Advisories/CVE-2021-23155 x_refsource_MISC