CVE-2020-16100

State: Published
Severity: 7.5 High
Published: Sep 15, 2020
Updated: Aug 4, 2024
Reserved: Jul 28, 2020

Description

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket (Configuration Client) connections. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Gallagher

Weaknesses

CWE-404 Improper Resource Shutdown or Release

Affected Products

Product	Versions
Command CentreGallagher	7.90 and earlierAffected 8.20 to before 8.20.1166 (MR3)Affected 8.10 to before 8.10.1211 (MR5)Affected 8.00 to before 8.00.1228 (MR6)Affected

References

https://security.gallagher.com/Security-Advisories/CVE-2020-16100

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.