CVE-2025-48428 - CVE House

Back to Database

Status published Medium CVE-2025-48428

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho...

6.7 CVSS

Vulnerability Description

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site. This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48428

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-48428

More from Gallagher

View All →

Missing Release of Resource after Effective Lifetime (CWE-772) in the...

Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335)...

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an...

Uncaught Exception (CWE-248) in the Command Centre Server allows an...

Exposure of Sensitive System Information to an Unauthorized Control Sphere...

Affected Vendor

Gallagher

View all reports →

Affected Software

Command Centre Server

Vulnerable Versions:

0, 9.20, 9.10, 9.00

Timeline

Official Publish: October 23rd, 2025

Last Modified: October 23rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1530 Data from Cloud Storage

T1078 Valid Accounts

T1041 Exfiltration Over C2 Channel