CVE-2025-48428

Executive Summary

CVE-2025-48428 is a high-severity vulnerability in Gallagher Command Centre Server, specifically within the Morpho biometric integration. The flaw involves the cleartext storage of a sensitive signing key (CWE-312). An authenticated attacker with access to the Command Centre Server can export this signing key while it is in use. This allows the attacker to deploy a compromised or counterfeit biometric device on the site, bypassing physical security controls. The vulnerability affects all versions of Command Centre Server 8.90 and prior, as well as versions 9.00, 9.10, and 9.20 before their respective maintenance releases. The CVSS score is 6.7 (Medium), but the impact on physical security is severe.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a proprietary on-premise security management system. The risk is limited to organizations that have deployed Gallagher Command Centre with the Morpho integration.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 6.7 (Medium)
• Attack Vector (AV): Local (L) – The attacker must have local access to the Command Centre Server.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the vulnerability.
• Privileges Required (PR): High (H) – The attacker must be an authenticated user with access to the server.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the security context of the server.
• Confidentiality (C): High (H) – The signing key is fully exposed.
• Integrity (I): High (H) – An attacker can deploy counterfeit devices, compromising system integrity.
• Availability (A): High (H) – The attacker could potentially disrupt the biometric authentication system.

Threat Level: High. While the CVSS score is Medium, the real-world impact on physical security is critical. An attacker can bypass biometric authentication, leading to unauthorized physical access.

Deep Dive & Mechanics

The vulnerability resides in the Gallagher Morpho integration, which handles biometric data and device authentication. The integration stores a cryptographic signing key in cleartext within the Command Centre Server's file system or database. This key is used to sign firmware or configuration updates for Morpho biometric readers.

Attack Flow:

1. Prerequisite: The attacker gains authenticated access to the Command Centre Server (e.g., via compromised admin credentials, insider threat, or lateral movement).
2. Key Extraction: The attacker locates and exports the cleartext signing key. The exact file path or registry key is not publicly disclosed, but it is stored in a predictable location.
3. Counterfeit Device Deployment: The attacker uses the stolen key to sign malicious firmware or configuration data. They then deploy a compromised or counterfeit Morpho biometric reader on the network.
4. Bypass: The compromised reader authenticates successfully with the Command Centre Server, allowing the attacker to bypass biometric checks (e.g., enroll fake fingerprints, allow unauthorized access).

The root cause is a failure to encrypt the signing key at rest. The key should be stored using a hardware security module (HSM) or encrypted with a strong, server-specific key.

Vulnerable vs. Patched Code

The exact code changes are not publicly available. However, the patch likely involves encrypting the signing key using a secure storage mechanism (e.g., Windows DPAPI, a dedicated HSM, or a key management service).

Vulnerable Code (Conceptual):

// Vulnerable: Key stored in cleartext
string signingKey = File.ReadAllText(@"C:\ProgramData\Gallagher\Morpho\signing_key.txt");

Patched Code (Conceptual):

// Patched: Key encrypted with DPAPI
byte[] encryptedKey = File.ReadAllBytes(@"C:\ProgramData\Gallagher\Morpho\signing_key.enc");
string signingKey = Encoding.UTF8.GetString(ProtectedData.Unprotect(encryptedKey, null, DataProtectionScope.LocalMachine));

Exploitation & Lab Setup

Red Team

Objective: Extract the cleartext signing key and deploy a counterfeit device.

Prerequisites:

• Access to a Gallagher Command Centre Server (vulnerable version) with the Morpho integration enabled.
• Administrative or high-privilege user credentials.

Steps:

1. Identify Key Location: Search for files containing the signing key. Common locations include:
   • C:\ProgramData\Gallagher\Morpho\
   • Registry keys under HKLM\SOFTWARE\Gallagher\Morpho
   • Configuration files (e.g., morpho_config.xml)
2. Extract Key: Use a simple file read or registry query.

   # Example: Read key from a file
   Get-Content "C:\ProgramData\Gallagher\Morpho\signing_key.txt"
   

3. Sign Malicious Payload: Use the extracted key to sign a counterfeit device firmware or configuration.

   # Example using OpenSSL (conceptual)
   openssl dgst -sha256 -sign signing_key.pem -out firmware.sig firmware.bin
   

4. Deploy Counterfeit Device: Connect a compromised Morpho reader to the network and upload the signed payload.

Note: No public exploit code is available. This is a conceptual attack.

Blue Team

Objective: Detect and prevent exploitation.

Detection:

• Monitor for unauthorized access to the C:\ProgramData\Gallagher\Morpho\ directory.
• Alert on processes reading the signing key file (e.g., notepad.exe, powershell.exe).
• Monitor for new, unrecognized Morpho devices connecting to the Command Centre Server.

Prevention:

• Apply the vendor patch immediately.
• Restrict access to the Command Centre Server using the principle of least privilege.
• Enable file integrity monitoring (FIM) on the signing key file.
• Use a hardware security module (HSM) for key storage if available.

Indicators of Compromise (IOCs)

• File Path: C:\ProgramData\Gallagher\Morpho\signing_key.txt (or similar cleartext file)
• Registry Key: HKLM\SOFTWARE\Gallagher\Morpho\SigningKey (if stored in registry)
• Process: Unauthorized processes reading the signing key file (e.g., powershell.exe, cmd.exe, wmic.exe)
• Network: New, unrecognized Morpho biometric readers appearing on the network.
• Logs: Event ID 4663 (An attempt was made to access an object) on the signing key file.

Detection Engineering

YARA Rule

rule CVE_2025_48428_Gallagher_SigningKey
{
    meta:
        description = "Detects cleartext Gallagher Morpho signing key file"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48428"
    strings:
        $key_header = "-----BEGIN PRIVATE KEY-----" nocase
        $key_footer = "-----END PRIVATE KEY-----" nocase
        $morpho_path = "Gallagher\\Morpho" nocase
    condition:
        ($key_header and $key_footer) or $morpho_path
}

Sigma Rule

title: Gallagher Morpho Signing Key Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to the cleartext signing key file for Gallagher Morpho integration.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48428
logsource:
    product: windows
    service: security
    category: file_access
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'Gallagher\Morpho\signing_key.txt'
    condition: selection
falsepositives:
    - Legitimate administrative access for patching
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-48428 Gallagher Morpho Key Exfiltration"; flow:to_server,established; content:"signing_key"; nocase; content:".txt"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to the following patched versions:
   • Command Centre Server 9.20: vEL9.20.2819 (MR4)
   • Command Centre Server 9.10: vEL9.10.3672 (MR7)
   • Command Centre Server 9.00: vEL9.00.3831 (MR8)
   • For versions 8.90 and prior, upgrade to a supported version.
2. Key Rotation: After patching, rotate all Morpho signing keys.
3. Access Review: Audit all users with access to the Command Centre Server. Remove unnecessary privileges.

Long-Term Mitigations:

• Implement a hardware security module (HSM) for key storage.
• Enable file integrity monitoring (FIM) on critical configuration files.
• Segment the Command Centre Server from the general corporate network.
• Conduct regular security assessments of physical access control systems.

Workaround (if patching is delayed):

• Restrict access to the C:\ProgramData\Gallagher\Morpho\ directory to only the service account running the Morpho integration.
• Monitor for unauthorized file access using Windows Event Logs.

Valters IT
Securing Your Digital Frontier