CRITICAL🇵🇱 Wersja polska

CVE-2020-16098

CVSS 9.8v3.1pub. 2020-09-15upd. 2024-11-21

It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166(MR3), versions of 8.10 prior to v8.10.1211(MR5), versions of 8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. These credentials can then be used to encode low security cards to be used by the system where insecure card technologies are supported.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Gallagher Command Centre

    APP
    Gallagher
    8.00.12288.10.12118.20.11668.30.12368.30 – 8.30.1236 (excl.)8.20 – 8.20.1166 (excl.)8.10 – 8.10.1211 (excl.)8.00 – 8.00.1228 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2024-21815CRITICAL9.1PL ✓same product

Gallagher Command Centre: niechronione dane uwierzytelniające integracji DVR

CVE-2021-23230CRITICAL9.9PL ✓same product

SQL Injection w interfejsie OPCUA Gallagher Command Centre

CVE-2021-23140CRITICAL9.9PL ✓same product

Nieprawidłowa autoryzacja w Gallagher Command Centre — modyfikacja makr

CVE-2020-16096CRITICAL9.9PL ✓same product

Gallagher Command Centre — nieautoryzowany dostęp do wrażliwych danych replikacji

CVE-2019-15294CRITICAL9.8PL ✓same product

Gallagher Command Centre: hasło logowane jawnym tekstem w pliku logu