CVE-2020-16100

HIGH

Gallagher Command Centre < 8.00.1228, 8.10 < 8.10.1211, 8.20 < 8.20.1166 - DoS via DCOM WebSocket

Title source: llm

Description

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket (Configuration Client) connections. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://security.gallagher.com/Security-Advisories/CVE-2020-16100

Scores

CVSS v3 7.5

EPSS 0.0104

EPSS Percentile 59.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-404

Status published

Products (4)

gallagher/command_centre 8.00.1228

gallagher/command_centre 8.10.1211

gallagher/command_centre 8.20.1166

gallagher/command_centre 8.00 - 8.00.1228

Published Sep 15, 2020

Tracked Since Feb 18, 2026