CVE-2025-46406 - Vulnerability Details - OpenCVE

A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.

This issue affects Command Centre Server:

9.30 prior to 9.30.1874 (MR1), 9.20 prior to 9.20.2337 (MR3), 9.10 prior to 9.10.3194 (MR6), 9.00 prior to 9.00.3371 (MR7), all versions of 8.90 and prior.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-46406

History

Thu, 10 Jul 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 10 Jul 2025 03:15:00 +0000

Type	Values Removed	Values Added
Description		A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary. This issue affects Command Centre Server: 9.30 prior to 9.30.1874 (MR1), 9.20 prior to 9.20.2337 (MR3), 9.10 prior to 9.10.3194 (MR6), 9.00 prior to 9.00.3371 (MR7), all versions of 8.90 and prior.
Weaknesses		CWE-270
References		https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-46406
Metrics		cvssV3_1 `{'score': 5.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Gallagher

Published: 2025-07-10T03:10:03.557Z

Updated: 2025-07-10T20:02:29.195Z

Reserved: 2025-06-17T02:18:59.193Z

Link: CVE-2025-46406

Vulnrichment

Updated: 2025-07-10T20:02:26.164Z

NVD

Status : Awaiting Analysis

Published: 2025-07-10T03:15:29.017

Modified: 2025-07-10T13:17:30.017

Link: CVE-2025-46406

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-46406", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "state": "PUBLISHED", "assignerShortName": "Gallagher", "dateReserved": "2025-06-17T02:18:59.193Z", "datePublished": "2025-07-10T03:10:03.557Z", "dateUpdated": "2025-07-10T20:02:29.195Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Command Centre Server", "vendor": "Gallagher", "versions": [{"lessThanOrEqual": "8.90", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "9.30.1874 (MR1)", "status": "affected", "version": "9.30", "versionType": "custom"}, {"lessThan": "9.20.2337 (MR3)", "status": "affected", "version": "9.20", "versionType": "custom"}, {"lessThan": "9.10.3194 (MR6)", "status": "affected", "version": "9.10", "versionType": "custom"}, {"lessThan": "9.00.3371 (MR7)", "status": "affected", "version": "9.00", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.</span>\n\n<p>This issue affects Command Centre Server: \n\n<span style=\"background-color: rgb(255, 255, 255);\">9.30 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.30.1874</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR1), 9.20 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.20.2337</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR3), 9.10 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.10.3194</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR6), </span><span style=\"background-color: rgb(255, 255, 255);\">9.00 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.00.3371</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR7), </span><span style=\"background-color: rgb(255, 255, 255);\">all versions of 8.90 and prior.</span>\n\n</p>"}], "value": "A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.\n\nThis issue affects Command Centre Server: \n\n9.30 prior to 9.30.1874\u00a0(MR1), 9.20 prior to 9.20.2337\u00a0(MR3), 9.10 prior to 9.10.3194\u00a0(MR6), 9.00 prior to 9.00.3371\u00a0(MR7), all versions of 8.90 and prior."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-270", "description": "CWE-270 Privilege Context Switching Error", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2025-07-10T03:10:03.557Z"}, "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-46406"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-10T20:02:21.159913Z", "id": "CVE-2025-46406", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T20:02:29.195Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-46406", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "state": "PUBLISHED", "assignerShortName": "Gallagher", "dateReserved": "2025-06-17T02:18:59.193Z", "datePublished": "2025-07-10T03:10:03.557Z", "dateUpdated": "2025-07-10T20:02:29.195Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Command Centre Server", "vendor": "Gallagher", "versions": [{"lessThanOrEqual": "8.90", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "9.30.1874 (MR1)", "status": "affected", "version": "9.30", "versionType": "custom"}, {"lessThan": "9.20.2337 (MR3)", "status": "affected", "version": "9.20", "versionType": "custom"}, {"lessThan": "9.10.3194 (MR6)", "status": "affected", "version": "9.10", "versionType": "custom"}, {"lessThan": "9.00.3371 (MR7)", "status": "affected", "version": "9.00", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.</span>\n\n<p>This issue affects Command Centre Server: \n\n<span style=\"background-color: rgb(255, 255, 255);\">9.30 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.30.1874</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR1), 9.20 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.20.2337</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR3), 9.10 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.10.3194</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR6), </span><span style=\"background-color: rgb(255, 255, 255);\">9.00 prior to </span><span style=\"background-color: rgb(255, 255, 255);\">9.00.3371</span><span style=\"background-color: rgb(255, 255, 255);\"> (MR7), </span><span style=\"background-color: rgb(255, 255, 255);\">all versions of 8.90 and prior.</span>\n\n</p>"}], "value": "A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform limited privileged activities across the Division boundary.\n\nThis issue affects Command Centre Server: \n\n9.30 prior to 9.30.1874\u00a0(MR1), 9.20 prior to 9.20.2337\u00a0(MR3), 9.10 prior to 9.10.3194\u00a0(MR6), 9.00 prior to 9.00.3371\u00a0(MR7), all versions of 8.90 and prior."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-270", "description": "CWE-270 Privilege Context Switching Error", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2025-07-10T03:10:03.557Z"}, "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-46406"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-46406", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-10T20:02:21.159913Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T20:02:26.164Z"}}]}}