CVE-2021-23197

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-18 · updated 2026-06-17
Weakness: CWE-428

Description

Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3) ;

Affected products

Gallagher Command Centre: from 8.50 before 8.50.2048 — fixed in 8.50.2048

How to fix

Upgrade to a fixed version: Gallagher Command Centre 8.50.2048. Check the vendor advisory for mitigations.

References

https://security.gallagher.com/Security-Advisories/CVE-2021-23197
https://security.gallagher.com/Security-Advisories/CVE-2021-23197

Get alerted when CVE-2021-23197 or the next vulnerability affects your stack