CVE-2026-27844
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An uncaught exception in the diagnostic web interface of Controller 6000 and Controller 7000 allows an authenticated and authorized operator to trigger a controller restart by sending specific requests, resulting in a temporary denial of service.
Risk Assessment
The risk involves a deliberate restart of the controller by a privileged operator, which can disrupt the access control system and cause temporary service unavailability.
Recommendation
It is recommended to immediately upgrade Command Centre to the versions specified in the description (9.20 MR7, 9.30 MR5, 9.40 MR3, 9.50 MR1 or later) and restrict access to the diagnostic interface to trusted operators only.
Original NVD description (English source)
Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.