CVE-2026-27790 - Vulnerability Details - OpenCVE

Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27790

History

Tue, 07 Jul 2026 05:00:00 +0000

Type	Values Removed	Values Added
Description		Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.
Weaknesses		CWE-248
References		https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27790
Metrics		cvssV3_1 `{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Gallagher

Published: 2026-07-07T03:49:10.293Z

Updated: 2026-07-07T03:49:10.293Z

Reserved: 2026-03-01T23:45:09.724Z

Link: CVE-2026-27790

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27790", "assignerOrgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "state": "PUBLISHED", "assignerShortName": "Gallagher", "dateReserved": "2026-03-01T23:45:09.724Z", "datePublished": "2026-07-07T03:49:10.293Z", "dateUpdated": "2026-07-07T03:49:10.293Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0c426f27-3ee1-4eff-be88-288d5a1822bc", "shortName": "Gallagher", "dateUpdated": "2026-07-07T03:49:10.293Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-248", "description": "CWE-248 Uncaught exception", "type": "CWE"}]}], "affected": [{"vendor": "Gallagher", "product": "T-20 Readers", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "9.10", "versionType": "custom"}, {"status": "affected", "version": "9.50", "lessThan": "vCR9.50.260616a", "versionType": "custom"}, {"status": "affected", "version": "9.40", "lessThan": "vCR9.40.260616a", "versionType": "custom"}, {"status": "affected", "version": "9.30", "lessThan": "vCR9.30.260616a", "versionType": "custom"}, {"status": "affected", "version": "9.20", "lessThan": "vCR9.20.260616a", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Uncaught Exception (CWE-248)\u00a0in\u00a0the T20 Readers\u00a0allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service.\u00a0Version of Command Centre affected:\n\n\n\n\n\n * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))\n * 9.40 prior to vCR9.40.260616a (distributed in\u00a09.40.3130(MR3))\n * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))\n * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))\n * all versions of 9.10 and prior.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Uncaught Exception (CWE-248) in<strong> </strong>the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. <div><span>Version of Command Centre affected</span><span>:</span></div><p></p><ul><li>9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1))</li><li>9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3))</li><li>9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5))</li><li>9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7))</li><li>all versions of 9.10 and prior. </li></ul>"}]}], "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-27790"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}}}