CVE-2020-16097

HIGH

Gallagher Command Centre < 7.90.1038 - Insufficiently Protected Credentials via Debug Port

Title source: llm

Description

On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed in v8.10.1211(MR5)), v8.00 prior to vGR8.00.165 (Distributed in v8.00.1228(MR6)), v7.90 prior to vGR7.90.165 (distributed in v7.90.1038(MRX)), v7.80 or earlier, It is possible to retrieve site keys used for securing MIFARE Plus and Desfire using debug ports on T Series readers.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://security.gallagher.com/Security-Advisories/CVE-2020-16097

Scores

CVSS v3 7.3

EPSS 0.0031

EPSS Percentile 22.1%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Details

CWE

CWE-522

Status published

Products (5)

gallagher/command_centre 7.90.1038

gallagher/command_centre 8.00.1228

gallagher/command_centre 8.10.1211

gallagher/command_centre 8.20.1093

gallagher/command_centre 7.90 - 7.90.1038

Published Sep 15, 2020

Tracked Since Feb 18, 2026