CVE-2025-35983 Details
Description
Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are connected. This issue affects Controller 7000: 9.30 prior to vCR9.30.250624a (distributed in 9.30.1871 (MR1)).
A vulnerability exists in Gallagher's Controller 7000 OneLink implementation due to improper certificate validation. This issue could enable an unprivileged attacker to cause a limited denial-of-service or to perform privileged overrides during the initial configuration of the Controller. Once the Controller is connected, this vulnerability no longer poses a risk. The issue affects Controller 7000 versions 9.30 prior to vCR9.30.250624a, which was distributed in 9.30.1871 (MR1).
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2025CISA-ADP
Assessed Jul 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-35983 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gallagher Controller 7000 | >= 9.30, < 9.30.250624a |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2025 | New CVE Received | [email protected] |