Paper/Archive/CVE-2020-16096

CVE-2020-16096

Gallagher Command Centre — In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior…

EPSS 0.8%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 56.6.566 × 2011.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be (or is) attached to a multi-server environment. This can include plain text credentials for DVR systems and card details used for physical access/alarm/perimeter components.

Affected

ProductAffectedFixed inSource

Command Centreunspecified – 7.70–CNA

Command Centre8.10 – < 8.10.1134(MR4)8.10.1134(MR4)CNA

Command Centre8.00 – < 8.00.1161(MR5)8.00.1161(MR5)CNA

Command Centre7.90 – < 7.90.991(MR5)7.90.991(MR5)CNA

Command Centre7.80 – < 7.80.960(MR2)7.80.960(MR2)CNA

Scores by source

Gallagher (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refsecurity.gallagher.com/Security-Advisories/CVE-2020-16096