Gallagher Group Command Centre Access Control Error Vulnerability

Gallagher Group Command Centre is a centralized control tool for Gallagher access control systems from Gallagher Group of New Zealand. An Access Control Error vulnerability exists in Gallagher Command Centre, which stems from an improper authentication vulnerability that allows an unauthenticated...

Gallagher Group Command Centre Code Issue Vulnerability

Gallagher Group Command Centre is a centralized control tool for Gallagher access control systems from Gallagher Group of New Zealand. A security vulnerability exists in Gallagher Group Command Centre that could be exploited by a remote attacker to crash the server or potentially cause remote cod...

CVE-2020-16101

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166MR3, v8.10 prior to v8.10.1211MR5, v8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier...

CVE-2020-16099

In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...

CVE-2020-16099

In Gallagher Command Centre v8.20 prior to v8.20.1093MR2 it is possible to create Guard Tour events that when accessed via things like reporting cause clients to temporarily hang or disconnect...

CVE-2020-16100

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket Configuration Client connections. Affected versions are...

CVE-2020-16096

In Gallagher Command Centre versions 8.10 prior to 8.10.1134MR4, 8.00 prior to 8.00.1161MR5, 7.90 prior to 7.90.991MR5, 7.80 prior to 7.80.960MR2, 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be or is attached to a multi-server...

CVE-2020-16096

In Gallagher Command Centre versions 8.10 prior to 8.10.1134MR4, 8.00 prior to 8.00.1161MR5, 7.90 prior to 7.90.991MR5, 7.80 prior to 7.80.960MR2, 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be or is attached to a multi-server...

CVE-2020-16098

It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166MR3, versions of 8.10 prior to v8.10.1211MR5, versions of 8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier. These...

CVE-2020-16098

It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166MR3, versions of 8.10 prior to v8.10.1211MR5, versions of 8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier. These...

CVE-2020-16100

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket Configuration Client connections. Affected versions are...

Command injection

In Gallagher Command Centre versions 8.10 prior to 8.10.1134MR4, 8.00 prior to 8.00.1161MR5, 7.90 prior to 7.90.991MR5, 7.80 prior to 7.80.960MR2, 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be or is attached to a multi-server...

Design/Logic Flaw

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166MR3, v8.10 prior to v8.10.1211MR5, v8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier...

Design/Logic Flaw

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket Configuration Client connections. Affected versions are...

Design/Logic Flaw

It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166MR3, versions of 8.10 prior to v8.10.1211MR5, versions of 8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier. These...

CVE-2020-16101

CVE-2020-16101 affects the Command Centre service. An unauthenticated remote DCOM websocket connection can crash the service due to an out-of-bounds buffer access. Affected versions: v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), and all versions o...

CVE-2020-16096

CVE-2020-16096 (Gallagher Command Centre) affects Gallagher Command Centre versions: 8.10 before 8.10.1134(MR4), 8.00 before 8.00.1161(MR5), 7.90 before 7.90.991(MR5), 7.80 before 7.80.960(MR2), and 7.70 and earlier. The issue allows any operator account to access data that would be replicated in...

CVE-2020-16096

In Gallagher Command Centre versions 8.10 prior to 8.10.1134MR4, 8.00 prior to 8.00.1161MR5, 7.90 prior to 7.90.991MR5, 7.80 prior to 7.80.960MR2, 7.70 and earlier, any operator account has access to all data that would be replicated if the system were to be or is attached to a multi-server...

CVE-2020-16098

It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166MR3, versions of 8.10 prior to v8.10.1211MR5, versions of 8.00 prior to v8.00.1228MR6, all versions of 7.90 and earlier. These...

CVE-2020-16098

CVE-2020-16098 affects Gallagher Command Centre. An unauthenticated network attacker can enumerate access card credentials on: v8.20 before 8.20.1166 (MR3); v8.10 before 8.10.1211 (MR5); v8.00 before 8.00.1228 (MR6); and all 7.90 and earlier. Credentials can be used to encode low-security cards w...