Listen to this Post
CVE-2026-27844 is a vulnerability affecting the diagnostic web interface of Gallagher Controller 6000 and Controller 7000 devices within the Command Centre security management platform. The root cause is an Uncaught Exception (CWE-248) that occurs when the diagnostic web interface processes specific, crafted requests from an authenticated user.
To exploit this vulnerability, an operator must already possess valid authentication credentials and be authorized to access the diagnostic web interface on the target Controller. The diagnostic interface is not intended for regular operational use; it is a specialized tool for troubleshooting and diagnostic purposes only. By sending a particular sequence or type of HTTP request to this interface, the attacker triggers an unhandled exception within the web server’s request-processing logic. Because the exception is not properly caught and managed by the application, it causes the underlying Controller service or the entire Controller device to restart unexpectedly.
This restart results in a temporary denial of service (DoS) condition. During the reboot cycle, the Controller is unable to perform its primary security functions, such as processing access control events, managing door locks, or communicating with other Command Centre components. The availability impact is considered Low because the service disruption is temporary and the Controller automatically restarts without requiring manual intervention. The vulnerability requires high privileges (authenticated and authorized operator) and cannot be triggered remotely without valid credentials. Gallagher has confirmed that there is no active exploitation of this vulnerability against customer sites at the time of publication.
The issue affects a wide range of Command Centre versions, specifically: 9.50 prior to vCR9.50.260616a, 9.40 prior to vCR9.40.260616a, 9.30 prior to vCR9.30.260616a, 9.20 prior to vCR9.20.260616a, and all versions of 9.10 and prior. Fixed versions are distributed in corresponding maintenance releases (MR): 9.50.1587(MR1), 9.40.3130(MR3), 9.30.3983(MR5), and 9.20.4349(MR7).
DailyCVE Form:
Platform: Gallagher Command Centre
Version: 9.10 and prior, 9.20<vCR9.20.260616a, 9.30<vCR9.30.260616a, 9.40<vCR9.40.260616a, 9.50<vCR9.50.260616a
Vulnerability: Uncaught Exception DoS
Severity: Low (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)
date: 07/07/2026
Prediction: Already patched (260616a builds)
What Undercode Say:
Check Command Centre version on Controller Navigate to Controller properties in Configuration Client Version information is displayed in the General tab Verify diagnostic web interface status via DIP switch DIP switch 1 OFF = interface disabled (default secure state) DIP switch 1 ON = interface enabled (only if advised by Gallagher Support) To check if DIP switch override is active: In Configuration Client > Controller property pages Verify "Dipswitch 1 controls the diagnostic web interface" is NOT checked Check for unauthorized "Enable WWW Connections" override This setting should NOT be used per Gallagher Hardening Guide
Exploit: (Educational Purposes!)
The exploitation vector requires authenticated access to the diagnostic web interface on TCP port 80 or 443 of the target Controller. An attacker with valid operator credentials can craft specific HTTP requests that trigger an uncaught exception in the web server’s request handler. The exact request parameters are not publicly disclosed, but the vulnerability resides in the exception handling logic of the diagnostic interface. Sending a malformed or unexpected sequence of requests causes the Controller service to crash and restart, resulting in a temporary denial of service. This attack cannot be performed without prior authentication and authorization.
Protection:
- Disable the diagnostic web interface – Ensure DIP switch 1 is turned OFF on all Controllers (this is the default configuration).
- In Configuration Client, on Controller property pages, verify that “Dipswitch 1 controls the diagnostic web interface” is NOT checked.
- Do not use the Controller override setting “Enable WWW Connections”.
- Refer to the Gallagher Command Centre Hardening Guide for comprehensive security recommendations.
- Apply the fixed versions – Upgrade to Command Centre vCR9.50.260616a, vCR9.40.260616a, vCR9.30.260616a, vCR9.20.260616a, or later.
Impact:
Successful exploitation allows an authenticated and authorized operator to trigger an unplanned restart of the Controller 6000 or Controller 7000 device. This results in a temporary denial of service where the Controller is unable to process access control events, manage connected peripherals, or communicate with the Command Centre server. The availability impact is limited to the duration of the reboot cycle, and the device automatically recovers without manual intervention. There is no impact on confidentiality or integrity of the system. The vulnerability is rated Low severity and is not known to be actively exploited in the wild.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
