Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-25193

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. 

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Gallagher

Description

Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gallagher Command Centre Server

Default version status: unaffected

  • 9.40 to < 9.40.2575 (MR2)affected

Gallagher Active Directory Sync

Default version status: affected

  • 0 to < 9.10.05affected

Gallagher Cardholder Sync Utility

Default version status: affected

  • 0 to < 9.30.104affected

Gallagher Diagnostics Service

Default version status: affected

  • 0 to < 2.0.9affected

Gallagher Elevator Service

Default version status: affected

  • 0 to < 10.0.8affected

Gallagher Encoding Kiosk Application

Default version status: affected

  • 0 to < 9.60.10affected

Gallagher Entra ID Sync

Default version status: unaffected

  • 1.0 to < 1.0.10affected
  • 2.0 to < 2.0.5affected

Gallagher Event Sync Utility

Default version status: affected

  • 0 to < 8.70.62affected

Gallagher Event Logger

Default version status: affected

  • 0 to < 8.90.16affected

Gallagher Middleware Framework

Default version status: affected

  • 0 to < 8.90.34affected

Gallagher Nexudus Integration

Default version status: affected

  • 0 to < 9.60.21affected

Gallagher Okta Sync

Default version status: affected

  • 0 to < 9.40.05affected

Gallagher Papercut Interface Integration

Default version status: affected

  • 0 to < 9.60.02affected

Gallagher SIP Integration

Default version status: affected

  • 0 to < 10.1.0affected

References