Technical impact
The vulnerability is an improper locking issue (CWE‑667) in the Gallagher Morpho integration. If exploited by a privileged operator, it allows the operator to trigger a lock that can cause a temporary interruption in service of the Command Centre Server. The impact is therefore a limited denial‑of‑service rather than a broad compromise of confidentiality or integrity.
Affected Systems
Gallagher Command Centre Server versions are affected: any release from 9.00 onward up to but not including vEL9.40.1976 (MR1), vEL9.30.3382 (MR4), vEL9.20.3783 (MR6), vEL9.10.4647 (MR9) and all earlier 9.40, 9.30, 9.20, 9.10, and 9.00 series. All versions older than vEL9.40.1976 are vulnerable.
Risk and Exploitability
The CVSS score of 2.5 indicates a low severity for this denial‑of‑service exploit, and the EPSS score of less than 1% suggests a very low probability of active exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, involving a privileged operator who has direct access to the Command Centre Server. There are no publicly known mitigations besides applying an update; the vendor does not provide a formal workaround.
