CVE-2020-16098

CVE-2020-16098 affects Gallagher Command Centre. An unauthenticated network attacker can enumerate access card credentials on: v8.20 before 8.20.1166 (MR3); v8.10 before 8.10.1211 (MR5); v8.00 before 8.00.1228 (MR6); and all 7.90 and earlier. Credentials can be used to encode low-security cards w...

CVE-2020-16100

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket Configuration Client connections. Affected versions are...

CVE-2020-16100

CVE-2020-16100 describes an unauthenticated remote DCOM websocket connection that can crash the Command Centre service’s DCOM websocket thread due to improper shutdown of closed websocket connections, preventing future DCOM websocket (Configuration Client) connections. Affected versions are v8.20...

CVE-2020-16099

In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...

CVE-2020-16099

Gallagher Command Centre (v8.20, prior to v8.20.1093MR2) is affected by CVE-2020-16099. The vulnerability allows attackers to create Guard Tour events that, when accessed (e.g., via reporting), can cause client applications to temporarily hang or disconnect. Public technical details are limited i...

CVE-2020-16101: Buffer Access with Incorrect Length Value

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166MR3, v8.10 prior to v8.10.1211MR5, v8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier...

PT-2020-14752

Name of the Vulnerable Software and Affected Versions Command Centre service versions prior to v8.20.1166 Command Centre service versions prior to v8.10.1211 Command Centre service versions prior to v8.00.1228 Command Centre service versions 7.90 and earlier Description The issue allows an...

PT-2020-14753

Name of the Vulnerable Software and Affected Versions Command Centre versions prior to 8.20.1166MR3 Command Centre versions prior to 8.10.1211MR5 Command Centre versions prior to 8.00.1228MR6 Command Centre versions 7.90 and earlier Description The issue allows an unauthenticated remote DCOM...

PT-2020-14751

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions prior to 8.20.1093MR2 Description The issue allows an attacker to create Guard Tour events that can cause clients to temporarily hang or disconnect when accessed through reporting. Recommendations For versions...

PT-2020-14750

Name of the Vulnerable Software and Affected Versions Command Centre versions prior to 8.20.1166MR3 Command Centre versions 8.10 prior to 8.10.1211MR5 Command Centre versions 8.00 prior to 8.00.1228MR6 Command Centre versions 7.90 and earlier Description It is possible to enumerate access card...

CVE-2020-16096: Improper Authorization

In Gallagher Command Centre versions 8.10 prior to 8.10.1134MR4, 8.00 prior to 8.00.1161MR5, 7.90 prior to 7.90.991MR5, 7.80 prior to 7.80.960MR2, 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be or is attached to a multi-server...

PT-2020-14748

Name of the Vulnerable Software and Affected Versions Gallagher Command Centre versions 7.70 and earlier Gallagher Command Centre versions 7.80 prior to 7.80.960MR2 Gallagher Command Centre versions 7.90 prior to 7.90.991MR5 Gallagher Command Centre versions 8.00 prior to 8.00.1161MR5 Gallagher...

CVE-2020-16099: Improper Input Validation

In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...

CVE-2020-16100: Improper Resource Shutdown or Release

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket Configuration Client connections. Affected versions are...

CVE-2020-16098: Improper Authentication

It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166MR3, versions of 8.10 prior to v8.10.1211MR5, versions of 8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier. These...

Gallagher Command Centre Information Disclosure Vulnerability

Gallagher Command Centre is the central management tool for the Gallagher Access Control System. An information disclosure vulnerability exists in Gallagher Command Center versions 7.x prior to 7.90.991 MR5, 8.00 prior to 8.00.1161 MR5, and 8.10 prior to 8.10.1134 MR4. The vulnerability stems fro...

CVE-2020-7215

An issue was discovered in Gallagher Command Centre 7.x before 7.90.991MR5, 8.00 before 8.00.1161MR5, and 8.10 before 8.10.1134MR4. External system configuration data used for third party integrations such as DVR systems were logged in the Command Centre event trail. Any authenticated operator wi...

CVE-2020-7215

An issue was discovered in Gallagher Command Centre 7.x before 7.90.991MR5, 8.00 before 8.00.1161MR5, and 8.10 before 8.10.1134MR4. External system configuration data used for third party integrations such as DVR systems were logged in the Command Centre event trail. Any authenticated operator wi...

Privilege escalation

An issue was discovered in Gallagher Command Centre 7.x before 7.90.991MR5, 8.00 before 8.00.1161MR5, and 8.10 before 8.10.1134MR4. External system configuration data used for third party integrations such as DVR systems were logged in the Command Centre event trail. Any authenticated operator wi...

CVE-2020-7215

An issue was discovered in Gallagher Command Centre 7.x before 7.90.991MR5, 8.00 before 8.00.1161MR5, and 8.10 before 8.10.1134MR4. External system configuration data used for third party integrations such as DVR systems were logged in the Command Centre event trail. Any authenticated operator wi...