CVE-2025-48430

Executive Summary

CVE-2025-48430 is a denial-of-service (DoS) vulnerability in Gallagher Command Centre Server, stemming from an uncaught exception (CWE-248). An authenticated, privileged operator can intentionally crash the server by triggering an unhandled exception, leading to service disruption. The vulnerability affects multiple versions of the Command Centre Server, with patches available for versions 9.00 through 9.30. No public exploit code or proof-of-concept has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. However, given the critical nature of physical access control systems, this vulnerability poses a significant risk to organizational security operations.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary software component of Gallagher Command Centre Server, a physical security and access control system. Organizations should verify the integrity of their Gallagher software distribution channels and ensure patches are obtained from official sources.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Local – The attacker must have local access to the Command Centre Server.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): High – The attacker must be an authorized and privileged operator.
• User Interaction (UI): None – No user interaction required.
• Scope (S): Unchanged – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None – No data exposure.
• Integrity (I): None – No data modification.
• Availability (A): High – Complete loss of service availability.

Threat Level: Medium. While the CVSS score is moderate, the impact on availability is high, and the attack requires high privileges. However, in a physical security context, a crashed server can disable access control, alarm monitoring, and video integration, creating significant operational and safety risks.

Deep Dive & Mechanics

The vulnerability is an uncaught exception (CWE-248) in the Command Centre Server. When a privileged operator performs a specific action (likely a crafted API call or administrative operation), the server throws an exception that is not properly handled. This causes the server process to terminate unexpectedly, resulting in a denial of service.

Root Cause: The server code lacks a try-catch block or equivalent error handling mechanism for certain operations. When an exceptional condition occurs (e.g., invalid input, resource exhaustion, or state inconsistency), the exception propagates up the call stack without being caught, leading to process termination.

Attack Vector: An authenticated operator with administrative privileges can intentionally trigger this condition. The attack is local, meaning the operator must have direct access to the server console or a management interface that allows execution of the vulnerable operation.

Impact: Successful exploitation results in the Command Centre Server crashing. This disrupts all services dependent on the server, including card access control, alarm monitoring, CCTV integration, and reporting. Recovery requires manual restart of the server process, causing downtime.

Vulnerable vs. Patched Code

Since the exact code is proprietary, we provide a conceptual comparison.

Vulnerable Code (Conceptual):

public void ProcessCommand(Command cmd)
{
    // No exception handling
    var result = ExecuteCommand(cmd);
    // If ExecuteCommand throws, the server crashes
}

Patched Code (Conceptual):

public void ProcessCommand(Command cmd)
{
    try
    {
        var result = ExecuteCommand(cmd);
    }
    catch (Exception ex)
    {
        LogError(ex);
        // Gracefully handle the exception without crashing
    }
}

The patch adds proper exception handling to catch and log exceptions, preventing the server from crashing. The server continues to operate, and the error is recorded for administrative review.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Gallagher Command Centre Server (version 9.00 to 9.30 pre-patch).
• Valid credentials with operator privileges (e.g., "Administrator" role).

Exploitation Steps:

1. Identify Target: Scan for Gallagher Command Centre Servers on the network (default port 443 for web interface, or 8080 for management).
2. Authenticate: Log in with privileged operator credentials.
3. Trigger Vulnerability: Perform a specific administrative action known to cause an uncaught exception. This could be:
   • Sending a malformed API request to the server's REST endpoint.
   • Importing a corrupted configuration file.
   • Executing a command with invalid parameters.
4. Observe Crash: The server process terminates. All connected clients lose connectivity.
5. Maintain Denial of Service: Repeatedly trigger the vulnerability to prevent server restart.

Example (Conceptual):

# Using curl to send a malformed request
curl -k -X POST "https://target:443/api/command" \
  -H "Authorization: Bearer <token>" \
  -d '{"command": "triggerCrash", "params": {"invalid": true}}'

Blue Team

Detection:

• Monitor for unexpected server process terminations (e.g., CCServer.exe or GallagherServer).
• Alert on repeated authentication failures followed by server crashes.
• Use application logs to identify unhandled exceptions.

Mitigation:

• Apply the vendor patch immediately.
• Restrict operator privileges to only necessary personnel.
• Implement network segmentation to limit access to the Command Centre Server.
• Enable application-level logging and monitoring.

Hunting:

• Search for event logs containing "unhandled exception" or "crash" near the time of service disruption.
• Correlate server crashes with specific user accounts or IP addresses.

Indicators of Compromise (IOCs)

• Process Termination: Unexpected exit of CCServer.exe or GallagherServer process.
• Event Logs: Windows Event ID 1000 (Application Error) for CCServer.exe.
• Network Traffic: Unusual API requests to /api/command or similar endpoints with malformed payloads.
• File Artifacts: Crash dump files (.dmp) in the server's installation directory.
• User Activity: Privileged operator performing administrative actions outside of normal business hours.

Detection Engineering

YARA Rule

rule CVE_2025_48430_Gallagher_DoS {
    meta:
        description = "Detects crash dump files or logs related to CVE-2025-48430"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-48430"
    strings:
        $s1 = "CCServer.exe" nocase
        $s2 = "unhandled exception" nocase
        $s3 = "Gallagher.CommandCentre.Server" nocase
        $s4 = "Faulting application name: CCServer.exe" nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Gallagher Command Centre Server Crash Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes of Gallagher Command Centre Server due to unhandled exception (CVE-2025-48430)
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48430
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        ApplicationName: 'CCServer.exe'
        FaultingModuleName: 'CCServer.exe'
    condition: selection
falsepositives:
    - Legitimate server crashes due to other reasons
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2025-48430 Gallagher Command Centre DoS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/command"; http_uri; content:"triggerCrash"; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to the following patched versions:
   • 9.30 MR2 (vEL9.30.2482)
   • 9.20 MR4 (vEL9.20.2819)
   • 9.10 MR7 (vEL9.10.3672)
   • 9.00 MR8 (vEL9.00.3831)
2. Workaround: If patching is not immediately possible, restrict operator privileges to only trusted personnel and monitor server logs for unusual activity.

Long-term Mitigations:

• Implement the principle of least privilege for all operator accounts.
• Enable comprehensive logging and alerting for server crashes.
• Conduct regular security audits of the Command Centre Server configuration.
• Ensure network segmentation between the Command Centre Server and other critical systems.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Monitor for abnormal server restarts or crashes.

Valters IT