Vulnerability · Published Nov 18, 2021 · Assigned by Gallagher
CVE-2021-23162
High 7.7
In plain English
A high-severity security flaw in Command Centre Mobile Connect for Android from Gallagher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 63.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Connect for Android 15 versions prior to 15.04.040; version 14 and prior versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gallagher | Command Centre Mobile Connect for Android | unspecified – through 1415 – before 15.04.040 |
Weakness: CWE-296 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
References
- https://security.gallagher.com/Security-Advisories/CVE-2021-23162 x_refsource_MISC