CVE-2020-16096
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be (or is) attached to a multi-server environment. This can include plain text credentials for DVR systems and card details used for physical access/alarm/perimeter components.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Gallagher | Command Centre | unspecified <= 7.70 | affected |
| Gallagher | Command Centre | 8.10 < 8.10.1134(MR4) | affected |
| Gallagher | Command Centre | 8.00 < 8.00.1161(MR5) | affected |
| Gallagher | Command Centre | 7.90 < 7.90.991(MR5) | affected |
| Gallagher | Command Centre | 7.80 < 7.80.960(MR2) | affected |
Weaknesses
- CWE-285: CWE-285 Improper Authorization
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.