CVE-2026-25193

Executive Summary

CVE-2026-25193 is a medium-severity vulnerability affecting Gallagher Command Centre Service installers. The flaw allows insertion of sensitive information (Service Account credentials) into log files (CWE-532). This exposure occurs only when a custom Service Account is used instead of the default Network Service account. The vulnerability has a CVSS score of 8.1, indicating high impact on confidentiality and integrity. No public exploit code or proof-of-concept is available, and the EPSS score is 0.0%, suggesting low exploitation likelihood. However, the risk is elevated for organizations using custom Service Accounts.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a configuration and installer log handling issue within the Gallagher Command Centre software ecosystem.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs low-privileged access.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact stays within the vulnerable component.
• Confidentiality Impact: High (C:H) – credentials exposed.
• Integrity Impact: High (I:H) – credentials can be reused.
• Availability Impact: High (A:H) – potential for full system compromise.

Threat Level: High for sites using custom Service Accounts. Low for default installations.

Deep Dive & Mechanics

The vulnerability stems from improper handling of sensitive information during the installation process of Command Centre Services. When a custom Service Account is specified, the installer writes the account credentials (username and password) into log files located in %programdata%/Gallagher/Command Centre. These log files are typically created with default permissions, allowing any local user with read access to the system to retrieve the credentials.

Root Cause: The installer does not sanitize or redact sensitive input before writing to log files. This violates the principle of least privilege and secure logging practices.

Attack Scenario:

1. An attacker gains low-privileged access to a Windows server running Gallagher Command Centre.
2. The attacker navigates to %programdata%/Gallagher/Command Centre and reads installer log files.
3. The attacker extracts the Service Account credentials (username and password).
4. The attacker uses these credentials to escalate privileges or move laterally within the network.

Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example of vulnerable logging in installer
import logging
logging.basicConfig(filename='install.log', level=logging.DEBUG)
def install_service(service_account, password):
    logging.info(f"Installing service with account: {service_account} and password: {password}")
    # ... installation logic

Patched Code (Conceptual):

# Example of patched logging
import logging
logging.basicConfig(filename='install.log', level=logging.INFO)
def install_service(service_account, password):
    logging.info(f"Installing service with account: {service_account}")
    # Password is never logged
    # ... installation logic

Note: No official patch is available. The mitigation involves manual cleanup and password rotation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows system with Gallagher Command Centre installed using a custom Service Account.
• Low-privileged user account.

Steps:

1. Open a command prompt or PowerShell as a low-privileged user.
2. Navigate to the log directory:

   cd %programdata%\Gallagher\Command Centre
   

3. List log files:

   dir *.log
   

4. Read the log file (e.g., install.log):

   type install.log
   

5. Extract the Service Account credentials from the log output.

Example Output:

[2026-01-15 10:30:45] INFO: Installing service with account: GALLAGHER\svc_command and password: P@ssw0rd123!

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unauthorized access to %programdata%\Gallagher\Command Centre directory.
2. Check for processes reading log files in that directory.
3. Review Windows Event Logs for unusual service account activity.

Response:

1. Immediately change the Service Account password.
2. Delete all installer log files in %programdata%\Gallagher\Command Centre.
3. Review access logs to determine if credentials were compromised.
4. Rotate any other credentials that may have been exposed.

Indicators of Compromise (IOCs)

• File Paths:
  • %programdata%\Gallagher\Command Centre\*.log
• Registry Keys:
  • HKLM\SOFTWARE\Gallagher\Command Centre (may contain log paths)
• Network Indicators:
  • Unusual authentication attempts using Service Account credentials.
• Process Indicators:
  • Processes reading log files in %programdata%\Gallagher\Command Centre (e.g., notepad.exe, cmd.exe, powershell.exe).

Detection Engineering

YARA Rule

rule CVE_2026_25193_Gallagher_Log_Exposure {
    meta:
        description = "Detects Gallagher Command Centre installer log files containing Service Account credentials"
        author = "Valters IT"
        date = "2026-01-15"
        reference = "CVE-2026-25193"
    strings:
        $credential_pattern = /(?:password|passwd|pwd)\s*[:=]\s*\S+/i
        $service_account_pattern = /(?:service account|svc_|service_user)/i
        $log_header = "Gallagher Command Centre Installer"
    condition:
        $log_header and $credential_pattern and $service_account_pattern
}

Sigma Rule

title: Gallagher Command Centre Service Account Credential Exposure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to Gallagher Command Centre installer log files that may contain Service Account credentials
author: Valters IT
date: 2026/01/15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25193
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\ProgramData\Gallagher\Command Centre\'
        TargetFilename|endswith: '.log'
    condition: selection
falsepositives:
    - Legitimate administrative access for troubleshooting
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-25193 Gallagher Command Centre Credential Exfiltration"; flow:to_server,established; content:"Gallagher Command Centre"; http_client_body; content:"password"; http_client_body; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the Service Account password for all affected installations.
2. Delete all installer log files from %programdata%\Gallagher\Command Centre.
3. Review system logs for any unauthorized access to the log directory.

Long-term Mitigation:

• Use the default Network Service account where possible.
• Implement secure logging practices (never log credentials).
• Restrict access to %programdata%\Gallagher\Command Centre to only authorized administrators.
• Monitor for CVE-2026-25193 patches from Gallagher.

Workaround:

• If custom Service Accounts are required, ensure log files are encrypted or stored in a secure location with restricted permissions.

Valters IT