Listen to this Post
CVE-2026-27790 is a low-severity vulnerability identified in Gallagher Command Centre’s T20 Readers component. The weakness is classified as CWE-248: Uncaught Exception, which occurs when the diagnostic web interface of the T20 Readers fails to properly handle exceptional conditions during request processing.
The vulnerability manifests when an authenticated and authorized operator sends specifically crafted requests to the T20 Reader’s diagnostic web page. Due to the lack of proper exception handling in the request processing path, an uncaught exception is triggered and propagates upward, ultimately causing the T20 Reader device to restart unexpectedly. This results in a temporary denial of service (DoS) condition, as the reader becomes unavailable during the restart cycle.
The attack requires the diagnostic web interface to be enabled on the Controller, which is disabled by default in standard configurations. The interface is controlled via DIP switch 1 on the Controller and a corresponding option in the Configuration Client. When enabled, the diagnostic web page is intended solely for troubleshooting purposes and is not meant for production use.
The CVSS v3.1 base score is 2.7 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L. This reflects a network-accessible attack vector, low attack complexity, but requires high privileges (authenticated operator) and no user interaction. The impact is limited to availability only, with no confidentiality or integrity compromise.
Affected versions include all Command Centre releases prior to specific patch versions: 9.50 before vCR9.50.260616a (MR1), 9.40 before vCR9.40.260616a (MR3), 9.30 before vCR9.30.260616a (MR5), 9.20 before vCR9.20.260616a (MR7), and all versions of 9.10 and earlier. The vulnerability was internally reported by Gallagher, and as of the advisory publication date, there is no evidence of active exploitation in the wild.
DailyCVE Form:
Platform: Gallagher Command Centre
Version: 9.10-9.50 (pre-patch)
Vulnerability: CWE-248 Uncaught Exception
Severity: Low (CVSS 2.7)
Date: 2026-07-07
Prediction: Patch available (MR builds)
What Undercode Say:
Check Command Centre version Navigate to Help > About in Command Centre Client Or check via registry/configuration files Verify Controller DIP switch 1 status Physical inspection required - DIP switch 1 should be OFF Check Configuration Client setting Navigate to Controller properties > Verify "Dipswitch 1 controls the diagnostic web interface" is NOT checked Verify no override is active Ensure "Enable WWW Connections" Controller override is NOT used To check if diagnostic web interface is accessible (from internal network) curl -k https://<controller-ip>/diagnostic Should return 404/error if disabled To test for vulnerability (Educational only - requires auth) Send crafted request to diagnostic endpoint curl -X POST https://<controller-ip>/diagnostic/endpoint \ -H "Authorization: Bearer <token>" \ -d "param=malicious_value" May trigger uncaught exception
Exploit: (Educational Purposes!)
The exploitation of CVE-2026-27790 requires the following conditions:
- Prerequisite: The target Controller must have DIP switch 1 enabled and the diagnostic web interface active. This is not the default configuration.
- Authentication: The attacker must possess valid operator credentials with authorization to access the T20 Reader.
- Attack Vector: The attacker sends a specific, malformed or unexpected request to the diagnostic web page endpoint of the T20 Reader.
- Trigger: The T20 Reader’s request handling code fails to catch an exception that occurs during processing of this specific request.
- Outcome: The uncaught exception propagates to the device’s main loop, causing the T20 Reader to restart.
- Denial of Service: During the restart cycle, the T20 Reader is temporarily unavailable for legitimate access control operations, resulting in a DoS condition.
No public proof-of-concept exploit is currently available for this vulnerability.
Protection:
- Primary Mitigation: Ensure DIP switch 1 is turned OFF on all Controllers.
- Configuration: Verify that the option “Dipswitch 1 controls the diagnostic web interface” is not checked in Configuration Client on Controller property pages.
- Override Prevention: Do not use the Controller override “Enable WWW Connections”.
- Apply Patches: Upgrade to the fixed versions:
- 9.50: vCR9.50.260616a (distributed in 9.50.1587 MR1)
- 9.40: vCR9.40.260616a (distributed in 9.40.3130 MR3)
- 9.30: vCR9.30.260616a (distributed in 9.30.3983 MR5)
- 9.20: vCR9.20.260616a (distributed in 9.20.4349 MR7)
- Version Upgrade: For 9.10 and earlier (no fix branch), migrate to a supported version.
- Hardening: Follow the Gallagher Command Centre Hardening Guide for additional security best practices.
- Monitoring: Restrict operator privileges and monitor operator actions, as exploitation requires authenticated access.
Impact:
- Availability: Temporary denial of service due to T20 Reader restart.
- Confidentiality: None reported.
- Integrity: None reported.
- Attack Surface: Limited to authenticated and authorized operators, significantly reducing exposure.
- Default Configuration: Diagnostic web interface is disabled by default, minimizing risk for standard deployments.
- No Active Exploitation: No evidence of in-the-wild exploitation at time of publication.
- Patch Availability: Fixed versions are available through maintenance releases (MR).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
