CVEvulnerability

CVE-2020-16096

7.7 HIGH Published 2020-09-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-09-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-285

Description

In Gallagher Command Centre versions 8.10 prior to 8.10.1134(MR4), 8.00 prior to 8.00.1161(MR5), 7.90 prior to 7.90.991(MR5), 7.80 prior to 7.80.960(MR2), 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be (or is) attached to a multi-server environment. This can include plain text credentials for DVR systems and card details used for physical access/alarm/perimeter components.

Affected configurations

• gallagher command centre (>= 7.80 < 7.80.960) • gallagher command centre (>= 7.90 < 7.90.991) • gallagher command centre (>= 8.00 < 8.00.1161) • gallagher command centre (>= 8.10 < 8.10.1134) • gallagher command centre 7.80.960 • gallagher command centre 7.90.991 • gallagher command centre 8.00.1161 • gallagher command centre 8.10.1134

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References