Auth bypass in Gallagher Command Centre
CVE-2020-16096
In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be (or is) attached to a multi-server environment. This can include plain text credentials for DVR systems and card details used for physical access/alarm/perimeter components.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Gallagher Command Centre — versions unspecified, 8.10, 8.00
- Gallagher Command Centre — versions 7.80.960, 7.90.991, 8.00.1161
Weakness classification (CWE)
References
- security.gallagher.com/Security-Advisories/CVE-2020-16096 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-16096?
- CVE-2020-16096 is a critical-severity vulnerability in Gallagher Command Centre, classified under Improper Authorization. CVSS score: 9.9/10. Published 2020-09-15.
- How severe is CVE-2020-16096?
- Critical severity. CVSS v3 base score is 9.9 out of 10.