CVE-2023-23576

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when competencies are used in the access decision.

This issue affects: Gallagher Command Centre: 8.90 prior to vEL8.90.1620 (MR2), 8.80 prior to vEL8.80.1369 (MR3), 8.70 prior to vEL8.70.2375 (MR5), 8.60 prior to vEL8.60.2550 (MR7), all versions of 8.50 and prior.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-696

Affected software

Vendor	Product	Versions
Gallagher	Command Centre Server	<= 8.50; >= 8.90, < 8.90.1620 (MR2); >= 8.80, < 8.80.1369 (MR3); >= 8.70, < 8.70.2375 (MR5); >= 8.60, < 8.60.2550 (MR7)

References

https://security.gallagher.com/Security-Advisories/CVE-2023-23576Vendor Advisory
https://security.gallagher.com/Security-Advisories/CVE-2023-23576Vendor Advisory

Timeline

Published: Dec 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-235777.3Uncontrolled search path element for some ITE Tech consumer infrared drivers before version 5.5.2.1 for Intel(R) NUC may allow an authentica CVE-2023-235787.5Improper access control vulnerability in SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier allows a remote unauthenticated attacker to co CVE-2023-235797.8Datakit CrossCadWare_x64.dll contains an out-of-bounds write past the end of an allocated buffer while parsing a specially crafted SLDPRT fi CVE-2023-23584.9Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Co CVE-2023-235807.8Stack-based buffer overflow for some Intel(R) Trace Analyzer and Collector software before version 2021.8.0 published Dec 2022 may allow an CVE-2023-235817.5A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. A spec CVE-2023-235829.8Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could allow an attacker to e CVE-2023-235837.8Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially CVE-2023-235844.3An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of CVE-2023-235857.5Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation CVE-2023-235865.5Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls CVE-2023-235886.3A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00