216.73.217.172

CVE-2025-41402

· Published 23/10/2025 04:16 · Modified 23/10/2025 04:16

Labels: CVE-2025-41402 2025-10-23CVE-2025-41402CWE-602[email protected]

Essential information

Published
23/10/2025 04:16
Modified
23/10/2025 04:16
Author
—
Creator
—
CVSS
5.5 MEDIUM (v3.1)
CISA KEV
No
CWE
—
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS metrics

Description

Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server:  9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.

NVD status

Status
Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
gallagher / command centre server cpe:2.3:a:gallagher:command_centre_server:<vEL9.30.2482:*:*:*:*:*:*
gallagher / command centre server cpe:2.3:a:gallagher:command_centre_server:<vEL9.20.2819:*:*:*:*:*:*
gallagher / command centre server cpe:2.3:a:gallagher:command_centre_server:<vEL9.10.3672:*:*:*:*:*:*
gallagher / command centre server cpe:2.3:a:gallagher:command_centre_server:*:*:*:*:*:*:*

References