CVE-2025-46406

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.

This issue affects Command Centre Server:

9.30 prior to 9.30.1874 (MR1), 9.20 prior to 9.20.2337 (MR3), 9.10 prior to 9.10.3194 (MR6), 9.00 prior to 9.00.3371 (MR7), all versions of 8.90 and prior.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-270

Affected software

Vendor	Product	Versions
Gallagher	Command Centre Server	<= 8.90; >= 9.30, < 9.30.1874 (MR1); >= 9.20, < 9.20.2337 (MR3); >= 9.10, < 9.10.3194 (MR6); >= 9.00, < 9.00.3371 (MR7)

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-46406

Timeline

Published: Jul 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-464078.8A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading CVE-2025-464089.8An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpC CVE-2025-464098.7Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is e CVE-2025-46419.3Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux CVE-2025-464106.1A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 a CVE-2025-464119.8A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch CVE-2025-464129.8Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication.CVE-2025-464135.3Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, CVE-2025-464148.1The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attac CVE-2025-464153.2A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.CVE-2025-464162.9The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user acc CVE-2025-464177.5The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS afte