CVE-2020-16098
CRITICALGallagher Command Centre < 8.00.1228 - Missing Authentication
Title source: ruleDescription
It is possible to enumerate access card credentials via an unauthenticated network connection to the server in versions of Command Centre v8.20 prior to v8.20.1166(MR3), versions of 8.10 prior to v8.10.1211(MR5), versions of 8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier. These credentials can then be used to encode low security cards to be used by the system where insecure card technologies are supported.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
https://security.gallagher.com/Security-Advisories/CVE-2020-16098
Scores
CVSS v3
9.8
EPSS
0.0109
EPSS Percentile
61.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-287
CWE-306
Status
published
Products (5)
gallagher/command_centre
8.00.1228
gallagher/command_centre
8.10.1211
gallagher/command_centre
8.20.1166
gallagher/command_centre
8.30.1236
gallagher/command_centre
8.00 - 8.00.1228
Published
Sep 15, 2020
Tracked Since
Feb 18, 2026