CVE-2025-46406

Executive Summary

CVE-2025-46406 is a Privilege Context Switching Error (CWE-270) affecting Gallagher Command Centre Server. This vulnerability allows a privileged Operator with high-level access in one Division to perform limited privileged activities across the Division boundary. The flaw resides in the server’s authorization logic, which fails to properly isolate privilege contexts when an operator is assigned to multiple divisions. An attacker with Operator-level credentials in one division can exploit this to gain unauthorized access to resources or perform actions in another division where they should have no privileges.

Impact: This is a cross-division privilege escalation vulnerability. While the CVSS score is moderate (5.6), the real-world risk is significant in multi-tenant or large enterprise deployments where strict division boundaries are critical for security and compliance. The vulnerability could allow a rogue operator to view or modify data in other divisions, potentially leading to data breaches or unauthorized system changes.

Affected Versions: All versions of Command Centre Server from 8.90 up to, but not including, the patched versions listed above. Users on 8.90 or earlier are particularly at risk as these versions are end-of-life and will not receive a patch.

Patch Status: Patches are available for supported versions (9.00, 9.10, 9.20, 9.30). Users on 8.90 or earlier must upgrade to a supported version to receive the fix.

CVSS Breakdown & Threat Level

CVSS Score: 5.6 (Medium) Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same network as the Command Centre Server. This is typical for internal enterprise deployments.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required. The exploit is straightforward.
• Privileges Required (PR): High (H) – The attacker must already have Operator-level credentials in at least one division.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Changed (C) – The vulnerability allows the attacker to impact resources in a different security context (another division).
• Confidentiality (C): Low (L) – Limited read access to data in other divisions.
• Integrity (I): Low (L) – Limited ability to modify data in other divisions.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The requirement for high privileges (Operator) reduces the likelihood of external exploitation, but the potential for insider threats or lateral movement by an already-compromised operator makes this a significant concern for organizations using multi-division setups.

Deep Dive & Mechanics

The vulnerability is a Privilege Context Switching Error (CWE-270). In Gallagher Command Centre, the system supports a multi-division architecture where operators can be assigned to one or more divisions. Each division has its own set of resources (doors, alarms, schedules, etc.) and operator permissions.

The flaw occurs in the server-side authorization logic when an operator is a member of multiple divisions. When the operator performs an action, the server should validate that the operator has the required privileges within the context of the target division. However, due to a bug in the privilege context switching mechanism, the server may incorrectly use the operator’s privileges from one division to authorize an action in another division.

Technical Walkthrough:

1. An operator Alice is created with high-level privileges (e.g., "Full Control") in Division A.
2. Alice is also added as a member of Division B, but with minimal privileges (e.g., "View Only").
3. When Alice attempts to perform a privileged action (e.g., unlocking a door) in Division B, the server should check her permissions in Division B.
4. Due to the bug, the server may fail to switch the privilege context from Division A to Division B, and instead use the high-level privileges from Division A to authorize the action in Division B.
5. This allows Alice to perform actions in Division B that exceed her intended permissions.

The root cause is likely a missing or incorrect privilege context switch in the server’s request handling pipeline. This could be in the form of a global variable that is not properly reset, a cached permission set that is not invalidated, or a flawed function that does not pass the correct division identifier.

Vulnerable vs. Patched Code

Since the source code is proprietary, we can only infer the fix based on the CWE and typical patching patterns.

Vulnerable Code (Conceptual):

// Vulnerable pseudocode
public bool AuthorizeAction(Operator op, Division targetDiv, Action action)
{
    // Bug: Uses the operator's "default" or "primary" division context
    Division contextDiv = op.PrimaryDivision; // or op.Divisions.First()
    PermissionSet perms = GetPermissions(op, contextDiv);
    return perms.HasPermission(action);
}

Patched Code (Conceptual):

// Patched pseudocode
public bool AuthorizeAction(Operator op, Division targetDiv, Action action)
{
    // Fix: Explicitly uses the target division for permission lookup
    PermissionSet perms = GetPermissions(op, targetDiv);
    return perms.HasPermission(action);
}

The patch likely involves ensuring that every authorization check explicitly uses the target division (the division where the action is being performed) rather than relying on a potentially incorrect default or cached context.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Gallagher Command Centre Server with a multi-division configuration.
• Valid Operator credentials for at least one division (Division A) with high-level privileges.
• The target operator must also be a member of another division (Division B) with limited privileges.

Exploitation Steps:

1. Identify Target Division: Determine the Division ID or name of the target division (Division B) where you want to escalate privileges.
2. Craft Malicious Request: Using the Gallagher API (likely SOAP or REST), craft a request to perform a privileged action in Division B. For example, unlocking a door or modifying an alarm schedule.
3. Send Request: Send the request using your Operator credentials from Division A.
4. Verify Escalation: If successful, the action will be performed in Division B despite your limited permissions there.

Example (Conceptual API Call):

POST /api/command/UnlockDoor HTTP/1.1
Host: command-centre-server:8080
Authorization: Bearer <token_for_operator_from_division_A>
Content-Type: application/json

{
  "doorId": "door_in_division_B",
  "divisionId": "division_B_id"
}

Note: No public exploit code is available. This is a theoretical exploitation based on the vulnerability description.

Blue Team (Detection & Prevention)

Detection:

• Monitor for API calls where an operator performs an action in a division where they have limited or no permissions.
• Look for anomalies in the audit log, such as an operator unlocking doors in a division they rarely access.
• Implement behavioral baselines for each operator and alert on deviations.

Prevention:

• Apply the vendor patch immediately.
• Implement strict network segmentation to limit access to the Command Centre Server.
• Use multi-factor authentication for all operator accounts.
• Regularly review operator permissions and division memberships.
• Enable detailed audit logging and monitor for suspicious activity.

Indicators of Compromise (IOCs)

Network IOCs:

• Unusual API calls to the Command Centre Server from an operator account targeting a division where the operator has low privileges.
• Repeated failed authorization attempts followed by a successful unauthorized action.

System IOCs:

• Audit log entries showing an operator performing actions in a division where they should not have sufficient privileges.
• Unexpected changes to door states, alarm schedules, or other security configurations in a division.

File IOCs:

• Modified configuration files related to division permissions (if the attacker gains further access).
• Suspicious log files or scripts on the Command Centre Server.

Detection Engineering

YARA Rule

rule CVE_2025_46406_Gallagher_Privilege_Escalation {
    meta:
        description = "Detects potential exploitation of CVE-2025-46406 in Gallagher Command Centre Server logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46406"
        severity = "medium"
    strings:
        $s1 = "UnlockDoor" nocase
        $s2 = "divisionId" nocase
        $s3 = "operatorId" nocase
        $s4 = "permission denied" nocase
        $s5 = "authorization failed" nocase
    condition:
        (all of ($s1, $s2, $s3)) or (any of ($s4, $s5))
}

Sigma Rule

title: CVE-2025-46406 - Gallagher Command Centre Cross-Division Privilege Escalation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-46406 by monitoring for API calls where an operator performs actions in a division with insufficient privileges.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46406
logsource:
    product: gallagher
    service: command_centre_server
detection:
    selection:
        EventID: 4624  # Example: Successful logon
        TargetDivisionID: 
            - 'division_B'
        OperatorDivisionID:
            - 'division_A'
    condition: selection
falsepositives:
    - Legitimate cross-division access if operator has proper permissions
level: medium

Suricata Rule

alert http $HOME_NET any -> $GALLAGHER_SERVER $HTTP_PORTS (
    msg:"CVE-2025-46406 - Potential Gallagher Command Centre Cross-Division Privilege Escalation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/command/"; http_uri;
    content:"divisionId"; http_client_body;
    pcre:"/\"divisionId\"\s*:\s*\"[^\"]+\"/";
    reference:cve,2025-46406;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to the patched versions as listed in the AFFECTED_VERSION section. For users on 8.90 or earlier, upgrade to a supported version (9.00 or later) and then apply the latest MR.
2. Workaround: If patching is not immediately possible, review and restrict operator memberships across divisions. Minimize the number of operators with high-level privileges in any division.
3. Monitor: Enable detailed audit logging and monitor for any signs of exploitation.

Long-Term Mitigations:

• Implement the principle of least privilege for all operator accounts.
• Regularly audit division memberships and permissions.
• Use network segmentation to isolate the Command Centre Server.
• Consider implementing additional access controls, such as requiring a second operator to authorize sensitive actions.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact your Valters IT representative.