External risk intelligence

Gallagher Command Centre Server Morpho Integration Information Exposure

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-47699

The vulnerability exists within the Command Centre Server's integration with Morpho devices, a component typically deployed in internal, restricted physical security environments. While the server is network-accessible, it is designed for controlled management of site hardware, making direct public-internet exposure uncommon and usually guarded by internal network controls.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in Gallagher Command Centre Server integrations with Morpho devices. The flaw could permit an authenticated user with limited permissions to enact significant alterations on local Morpho hardware. While the direct business impact is currently assessed as unlikely due to typical deployment environments, confirming the relevance and exposure within your specific infrastructure is the primary concern.

Sensitive system information exposed to unauthorized access.
High impact if an authenticated, low-privilege user exploits.
Confirm relevance and potential exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could begin by gaining authenticated access to the Gallagher Command Centre Server with limited permissions. From there, they could target the Morpho integration, a component responsible for managing local Morpho devices. By exploiting this vulnerability, the attacker could potentially make unauthorized and critical modifications to these devices. The exact method for reaching and triggering this vulnerability is not detailed.

Authenticated access required.
Vulnerable Morpho integration.
Unauthorized device control.

Live Threat

Current exploitation, exposure, and threat context

An authenticated operator with limited permissions could make critical changes to local Morpho devices through an integration with Gallagher Command Centre Server. This could affect the operational status and configuration of these devices.

Morpho device configurations at risk.
Changes made via authenticated operator access.
Compromised device functionality and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners responsible for Gallagher Command Centre Server and its integrated Morpho devices must prioritize identifying all deployments and confirming their business criticality and network exposure. The initial action involves locating affected systems, assessing their reachability and importance, and then engaging the accountable owner to plan a risk-based remediation strategy.

Ownership: Command Centre Server and Morpho integration owners.
Verify first: System reachability and business criticality.
Next action: Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Gallagher Command Centre Server and its Morpho integration?

Gallagher Command Centre Server is a centralized security platform used to manage site operations and access control. The Morpho integration is a specific software component that links this server to Morpho biometric devices, allowing administrators to manage and configure hardware for identity verification and physical entry.

What does CWE-497 mean for CVE-2025-47699?

CWE-497, or Exposure of Sensitive System Information to an Unauthorized Control Sphere, describes a weakness where internal system data is inadvertently revealed to users who shouldn't see it. In the context of this CVE, this vulnerability allows a low-privileged operator to gain enough system insight to perform unauthorized, critical actions on connected Morpho hardware.

How can an attacker trigger this vulnerability?

To trigger this issue, an attacker must already have authenticated access to the Gallagher Command Centre Server, even if that account has limited permissions. It is important to note that unauthenticated users cannot trigger this bug; the flaw relies on an existing, authorized session within the management software to abuse the integration's trust.

Is my system at risk if it is not on the internet?

According to Halo Surface Signal, this vulnerability is unlikely to be exploited because Morpho integrations are typically restricted to internal, private physical security networks. While the server itself communicates over a network, its placement within a controlled environment significantly reduces the likelihood of external exploitation compared to public-facing systems.

What should I do if I run Gallagher Command Centre?

Your first step is to identify where you have deployed the Morpho integration within your environment. Once located, assess the business criticality of these systems and confirm their network accessibility. Consult the official Gallagher security advisory to determine if your specific software version is affected and coordinate with your technical team to plan an update or risk-mitigation strategy.

References

security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-47699

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.