CVE-2025-48428 - Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site

Back Back to CVE browser

MEDIUM

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site

Published Oct 23, 2025

6.7

MEDIUM

CVSS 3.1

EPSS 0.10%

Description

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site. This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.

Affected products

Vendor Gallagher Product Command Centre Server Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=8.90
- Version
  9.00
  Status
  affected
  Constraints
  <9.00.3831 (MR8)
- Version
  9.10
  Status
  affected
  Constraints
  <9.10.3672 (MR7)
- Version
  9.20
  Status
  affected
  Constraints
  <9.20.2819 (MR4)