Security readout for executives and security teams
Plain-English summary
Gallagher Command Centre could expose sensitive OSDP key material to Command Centre Operators. In affected physical access-control deployments, an account with operator-level access may see information that should be protected, creating confidentiality and integrity risk for the access-control environment.
Executive priority
Treat as high priority for sites using Gallagher Command Centre because exposed key material can affect trust in access-control operations. Prioritize upgrade and operator access review, but do not assume active exploitation from the supplied evidence.
Technical view
CVE-2021-23204 is a CWE-200 information exposure issue in Gallagher Command Centre Server. CVSS 3.1 is 8.1 with network attack vector, low complexity, low privileges, no user interaction, and high confidentiality and integrity impact. Affected releases are 8.40 before 8.40.1888 MR3 and 8.30 before 8.30.1359 MR3.
Likely exposure
Exposure is likely limited to organizations running Gallagher Command Centre 8.30 or 8.40 before the listed MR3 builds, especially where Command Centre Operator accounts exist or are broadly assigned.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The CVSS vector indicates exploitation requires network access and low privileges, not unauthenticated access.
Researcher notes
The bundle identifies the affected versions, fixed minimum builds, CWE-200 class, and CVSS vector. It does not provide proof-of-concept status, exploit telemetry, or detailed vulnerable code behavior, so validation should focus on version exposure and role-based access review.
Mitigation direction
- Upgrade Command Centre 8.40 to 8.40.1888 MR3 or later.
- Upgrade Command Centre 8.30 to 8.30.1359 MR3 or later.
- Review Gallagher’s advisory for version-specific guidance.
- Limit Command Centre Operator access to users with a business need.
- Review OSDP key handling guidance if exposure is suspected.
Validation and detection
- Inventory all Gallagher Command Centre Server versions.
- Confirm no 8.40 systems are below 8.40.1888 MR3.
- Confirm no 8.30 systems are below 8.30.1359 MR3.
- Review current Command Centre Operator assignments.
- Check vendor advisory notes before closing remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-23204 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://security.gallagher.com/Security-Advisories/CVE-2021-23204CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.