Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2025-47699 β€” AI Deep Analysis Summary

CVSS 9.9 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Sensitive system info exposure in Gallagher Morpho integration. <br>πŸ’₯ **Consequences**: Unauthorized critical changes to building infrastructure.…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **Root Cause**: **CWE-497** (Exposure of Sensitive System Information to Unauthorized Actors). Flaw lies in the Morpho integration layer leaking critical data.

Q3Who is affected? (Versions/Components)

🏒 **Affected**: Gallagher Command Centre Server. <br>πŸ“‰ **Versions**: <br>β€’ 9.30 to vEL9.30.2482 <br>β€’ 9.20 to vEL9.20.2819 <br>β€’ 9.10 to vEL9.10.3672 <br>β€’ 9.00 to vEL9.0

Q4What can hackers do? (Privileges/Data)

πŸ•΅οΈ **Hacker Actions**: <br>β€’ Access sensitive system info. <br>β€’ Make **unauthorized critical changes**. <br>β€’ Potentially compromise building security systems.

Q5Is exploitation threshold high? (Auth/Config)

πŸ”‘ **Threshold**: **Medium**. Requires **Local Privileges** (PR:L). Not remote unauthenticated (AV:N/AC:L), but needs some access level.

Q6Is there a public Exp? (PoC/Wild Exploitation)

πŸ’£ **Public Exp?**: **No**. The `pocs` field is empty. No public PoC or wild exploitation confirmed yet.

Q7How to self-check? (Features/Scanning)

πŸ” **Self-Check**: <br>β€’ Scan for **Gallagher Command Centre Server**. <br>β€’ Verify installed version against the affected list. <br>β€’ Check Morpho integration logs for info leaks.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: **Yes**. Official advisory released. Update to the specific fixed versions listed in the vendor security page.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: <br>β€’ Restrict access to Morpho integration components. <br>β€’ Implement strict network segmentation. <br>β€’ Monitor for unauthorized configuration changes.

Q10Is it urgent? (Priority Suggestion)

⚑ **Urgency**: **High**. CVSS Score indicates **Critical** impact (H/H/H). Even with auth requirement, the potential for critical infrastructure damage is severe. Patch immediately!