---
id: CVE-2026-20801
title: "Cleartext Transmission of Sensitive Information (CWE-319) in\_a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations\_allows unprivileged users with local network access to view live video streams"
summary: "Cleartext Transmission of Sensitive Information (CWE-319) in\_a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations\_allows unprivileged users with local network access to view live video streams. \n\n \n\nThis …"
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-319
vendor: gallagher
product: hanwha_vms_integration
affected:
  - hanwha_vms_integration < 9.10.025
  - nx_witness_vms_integration < 9.10.017
patched:
  - hanwha_vms_integration 9.10.025
  - nx_witness_vms_integration 9.10.017
published: '2026-03-03'
updated: '2026-08-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20801'
references:
  - url: 'https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2026-20801'
    label: disclosures@gallagher.com
tags:
  - nvd
epss: 0.00102
epssPercentile: 0.00853
ingestedAt: '2026-08-17T19:59:45.111Z'
---

## Overview

Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams. 

 

This issue affects all versions of Gallagher NxWitness VMS integration prior to 9.10.017 and Gallagher Hanwha VMS integration prior to 9.10.025.

## Affected

- `hanwha_vms_integration < 9.10.025`
- `nx_witness_vms_integration < 9.10.017`

## Remediation

Upgrade past the affected range:

- `hanwha_vms_integration 9.10.025`
- `nx_witness_vms_integration 9.10.017`