CVE-2022-26348

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions prior to 8.60.1652 Gallagher Command Centre versions prior to 8.50.2245 Gallagher Command Centre versions prior to 8.40.2216 Gallagher Command Centre versions prior to 8.30.1470 Gallagher Command Centre version 8.20 and prior versions

Description The issue is related to SQL Injection via Windows Registry settings for date fields on the server. An attacker using the Visitor Management Kiosk can invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information.

Recommendations For versions prior to 8.60.1652, update to version 8.60.1652 or later. For versions prior to 8.50.2245, update to version 8.50.2245 or later. For versions prior to 8.40.2216, update to version 8.40.2216 or later. For versions prior to 8.30.1470, update to version 8.30.1470 or later. For version 8.20 and prior versions, update to a version later than 8.20.