CVE-2026-27790

Executive Summary

CVE-2026-27790 is a low-severity Denial of Service (DoS) vulnerability affecting Gallagher T20 Readers within the Gallagher Command Centre ecosystem. The flaw is rooted in an uncaught exception (CWE-248) that can be triggered by an authenticated and authorized operator sending specific, crafted requests to the reader. This causes the T20 Reader to restart, resulting in a temporary loss of access control functionality for the affected door or barrier.

The vulnerability has a CVSS score of 2.7 (Low), reflecting the requirement for authenticated access and the limited impact (temporary DoS). No public proof-of-concept (PoC) code or exploit is currently available, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. The vendor, Gallagher, has released patches for supported versions of Command Centre.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary hardware/software ecosystem from Gallagher. The supply chain risk is limited to the integrity of the Gallagher firmware and software updates. Organizations should ensure they obtain patches directly from Gallagher's official distribution channels and verify file hashes if provided.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Network (N) - The attack is carried out over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for the attack.
• Privileges Required (PR): High (H) - The attacker must be an authenticated and authorized operator within the Command Centre system.
• User Interaction (UI): None (N) - No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the T20 Reader.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): Low (L) - The reader restarts, causing a temporary denial of service.

Threat Level: Low. The requirement for high privileges significantly reduces the attack surface. This vulnerability is most likely to be exploited by a malicious insider or an attacker who has already compromised operator credentials.

Deep Dive & Mechanics

The vulnerability resides in the firmware of Gallagher T20 Readers. The T20 is a physical access control reader that communicates with the Gallagher Command Centre server.

Root Cause: The reader fails to properly handle specific, malformed, or unexpected network requests from an authenticated operator. This leads to an uncaught exception in the reader's software.

Trigger Mechanism: An operator with valid credentials and authorization can send a crafted request to the T20 Reader. The exact nature of the request is not publicly disclosed, but it likely involves a specific command or data sequence that the reader's input validation logic does not handle correctly.

Impact: When the uncaught exception occurs, the reader's software crashes. The T20 Reader is designed to restart automatically upon a software crash. This restart process takes a few seconds to a minute, during which the reader is unavailable. This means the door or barrier controlled by that reader cannot be unlocked or locked, and access events are not recorded.

Affected Versions: The vulnerability affects all versions of Command Centre 9.10 and prior, as well as versions 9.20, 9.30, 9.40, and 9.50 before the specific maintenance releases (MRs) listed.

Vulnerable vs. Patched Code

Since this is a proprietary firmware vulnerability, the exact code diff is not publicly available. However, the fix can be described conceptually.

Vulnerable Code (Conceptual):

// Vulnerable pseudo-code for request handling
void handle_operator_request(Request *req) {
    // ... process request ...
    // No try-catch block around potentially dangerous operation
    process_special_command(req->data);
    // If process_special_command throws an exception, it propagates up
    // and crashes the main loop, causing a restart.
}

Patched Code (Conceptual):

// Patched pseudo-code for request handling
void handle_operator_request(Request *req) {
    // ... process request ...
    try {
        process_special_command(req->data);
    } catch (Exception &e) {
        // Log the error and gracefully handle the request
        log_error("Failed to process special command: %s", e.what());
        send_error_response(req, "Internal error");
        // Do not crash; continue processing other requests
    }
}

The patch likely involves adding proper exception handling (try-catch blocks) around the code that processes operator requests. This prevents the uncaught exception from crashing the entire reader process.

Exploitation & Lab Setup

No public exploit code is available for this CVE.

Red Team

1. Prerequisites: Obtain valid credentials for an operator account with authorization to send commands to T20 Readers.
2. Reconnaissance: Identify the IP addresses of T20 Readers on the network. This can be done via network scanning (e.g., Nmap) or by querying the Command Centre server.
3. Crafting the Payload: The specific payload is unknown. Red teamers would need to reverse-engineer the T20 reader protocol or perform fuzzing to discover the exact request that triggers the exception.
4. Execution: Send the crafted request to the target T20 Reader.
5. Verification: Observe the reader restarting. This can be confirmed by a temporary loss of connectivity (e.g., ping fails for a few seconds) or by monitoring the Command Centre logs for reader disconnection/reconnection events.

Hypothetical Exploit Script (Python):

import socket
import struct

# Hypothetical payload - this is NOT a working exploit
# It represents the type of data that might trigger the vulnerability
def trigger_restart(target_ip, target_port=443):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    try:
        sock.connect((target_ip, target_port))
        # Craft a malformed request that causes an uncaught exception
        # This is a placeholder for the actual vulnerable request
        malformed_payload = b"\x00\x01\x02\xFF" * 100
        sock.send(malformed_payload)
        response = sock.recv(1024)
        print(f"Response: {response}")
    except Exception as e:
        print(f"Error: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    trigger_restart("192.168.1.100")

Blue Team

1. Detection: Monitor for unusual network traffic to T20 Readers. Look for patterns of repeated failed authentication attempts or malformed packets.
2. Log Analysis: In the Command Centre logs, look for events indicating a reader has unexpectedly disconnected and reconnected. Correlate these events with specific operator accounts.
3. Honeypot: Deploy a decoy T20 Reader (or simulate one) to capture and analyze any attempts to exploit this vulnerability.
4. Network Segmentation: Ensure T20 Readers are on a separate VLAN from general user workstations. Restrict access to the reader management interface to only authorized administrative workstations.
5. Principle of Least Privilege: Review operator permissions. Ensure that only operators who absolutely need to send commands to readers have that authorization.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Unusual or malformed TCP packets sent to port 443 (or the configured management port) of T20 Readers.
  • Repeated connection attempts from a single operator workstation to multiple T20 Readers in a short period.
• System Logs (Command Centre):
  • Log entries showing a T20 Reader disconnecting and reconnecting without a clear cause (e.g., power cycle).
  • Log entries associated with a specific operator account that correlate with reader restarts.
• Host-Based (T20 Reader):
  • The reader's uptime counter resetting unexpectedly.
  • Crash dump files (if the reader generates them) being created.

Detection Engineering

YARA Rule

rule CVE_2026_27790_T20_Reader_DoS {
    meta:
        description = "Detects potential exploit traffic targeting Gallagher T20 Reader DoS vulnerability"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-27790"
        hash = "unknown"
    strings:
        // Look for patterns of repeated malformed requests
        $s1 = { 00 01 02 ff } // Example malformed sequence
        $s2 = "T20" nocase
        $s3 = "restart" nocase
    condition:
        // Trigger on network traffic containing the malformed sequence
        // and references to the T20 reader
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: Gallagher T20 Reader DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic patterns associated with CVE-2026-27790 exploitation attempts.
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27790
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        dest_port: 443
        # Look for connections with a high number of small packets
        # or connections that are immediately followed by a disconnect
        # This is a generic indicator of a DoS attempt
        orig_bytes: < 100
        resp_bytes: < 100
        duration: < 1
    condition: selection
falsepositives:
    - Legitimate administrative traffic
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2026-27790 Gallagher T20 Reader DoS Attempt"; flow:to_server,established; content:"|00 01 02 ff|"; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade the Gallagher Command Centre software to the patched versions:
   • 9.50: Upgrade to 9.50.1587 (MR1) or later.
   • 9.40: Upgrade to 9.40.3130 (MR3) or later.
   • 9.30: Upgrade to 9.30.3983 (MR5) or later.
   • 9.20: Upgrade to 9.20.4349 (MR7) or later.
   • 9.10 and prior: Upgrade to a supported version (e.g., 9.20 or later) and then apply the relevant patch.
2. Workaround: If patching is not immediately possible, restrict network access to T20 Readers to only authorized administrative workstations. Implement strict firewall rules.

Long-Term Mitigations:

1. Network Segmentation: Place all physical access control devices (readers, controllers) on a dedicated, isolated network segment.
2. Access Control: Enforce the principle of least privilege for all operator accounts. Regularly audit operator permissions.
3. Monitoring: Implement continuous monitoring of network traffic to and from T20 Readers. Set up alerts for unusual patterns.
4. Vendor Communication: Subscribe to Gallagher's security advisories to stay informed of future vulnerabilities and patches.

Valters IT