| Package | Affected versions | Patched versions |
|---|---|---|
| active directory sync | < 9.10.05 | 9.10.05 |
| cardholder sync utility | < 9.30.104 | 9.30.104 |
| command centre | < 9.40.2575 | 9.40.2575 |
| diagnostics service | < 2.0.9 | 2.0.9 |
| elevator service | < 10.0.8 | 10.0.8 |
| encoding kiosk application | < 9.60.10 | 9.60.10 |
| entra id sync v1 | < 1.0.10 | 1.0.10 |
| entra id sync v2 | < 2.0.5 | 2.0.5 |
| event logger | < 8.90.16 | 8.90.16 |
| event sync utility | < 8.70.62 | 8.70.62 |
| middleware framework | < 8.90.34 | 8.90.34 |
| nexudus integration | < 9.60.21 | 9.60.21 |
| okta sync | < 9.40.05 | 9.40.05 |
| papercut interface integration | < 9.60.02 | 9.60.02 |
| sip integration | < 10.10 | 10.10 |
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free