Read the docs
TI-2020-12672 Aliases CVE-2020-16102GHSA-4x7r-2g5v-6xmq

Improper authentication in Gallagher Command Centre

Priority LOW 38CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Improper Authentication vulnerability in Gallagher Command Centre Server allows an unauthenticated remote attacker to create items with invalid configuration, potentially causing the server to crash and fail to restart. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1299(MR2); 8.20 versions prior to 8.20.1218(MR4); 8.10 versions prior to 8.10.1253(MR6); 8.00 versions prior to 8.00.1252(MR7); version 7.90 and prior versions.

Why it matters now

EPSS 0.01041 64th percentileScored 2026-11-07
Fix Fixed Command Centre (Gallagher): 8.30.1299(MR2), 8.20.1218(MR4), 8.10.1253(MR6) +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GallagherCommand Centreup to 7.90; 8.30 to before 8.30.1299(MR2); 8.20 to before 8.20.1218(MR4); 8.10 to before 8.10.1253(MR6); 8.00 to before 8.00.1252(MR7)8.30.1299(MR2), 8.20.1218(MR4), 8.10.1253(MR6), 8.00.1252(MR7)Patch availableCNA
  • Command Centre VendorGallagher Affected up to 7.90; 8.30 to before 8.30.1299(MR2); 8.20 to before 8.20.1218(MR4); 8.10 to before 8.10.1253(MR6); 8.00 to before 8.00.1252(MR7) Fixed in 8.30.1299(MR2), 8.20.1218(MR4), 8.10.1253(MR6), 8.00.1252(MR7) Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*before 7.90.0; 8.00 to before 8.00.1252; 8.10 to before 8.10.1253; 8.20 to before 8.20.1218; 8.30 to before 8.30.1299VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.00.1252:-:*:*:*:*:*:*8.00.1252VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.00.1252:maintenance_release7:*:*:*:*:*:*8.00.1252 maintenance_release7VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.10.1253:-:*:*:*:*:*:*8.10.1253VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.10.1253:maintenance_release6:*:*:*:*:*:*8.10.1253 maintenance_release6VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.20.1218:-:*:*:*:*:*:*8.20.1218VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.20.1218:maintenance_release4:*:*:*:*:*:*8.20.1218 maintenance_release4VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.30.1299:-:*:*:*:*:*:*8.30.1299VulnerableGallagher
cpe:2.3:a:gallagher:command_centre:8.30.1299:maintenance_release2:*:*:*:*:*:*8.30.1299 maintenance_release2VulnerableGallagher
  • cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:* Versions before 7.90.0; 8.00 to before 8.00.1252; 8.10 to before 8.10.1253; 8.20 to before 8.20.1218; 8.30 to before 8.30.1299 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.00.1252:-:*:*:*:*:*:* Versions 8.00.1252 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.00.1252:maintenance_release7:*:*:*:*:*:* Versions 8.00.1252 maintenance_release7 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.10.1253:-:*:*:*:*:*:* Versions 8.10.1253 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.10.1253:maintenance_release6:*:*:*:*:*:* Versions 8.10.1253 maintenance_release6 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.20.1218:-:*:*:*:*:*:* Versions 8.20.1218 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.20.1218:maintenance_release4:*:*:*:*:*:* Versions 8.20.1218 maintenance_release4 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.30.1299:-:*:*:*:*:*:* Versions 8.30.1299 Vulnerable ·Gallagher
  • cpe:2.3:a:gallagher:command_centre:8.30.1299:maintenance_release2:*:*:*:*:*:* Versions 8.30.1299 maintenance_release2 Vulnerable ·Gallagher

Remediation

  • Fix · CNA Command Centre (Gallagher) Fixed in 8.30.1299(MR2), 8.20.1218(MR4), 8.10.1253(MR6), 8.00.1252(MR7)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-16102
  2. 2026-10-03 Alias added: GHSA-4x7r-2g5v-6xmq

References

Advisory 1

  • TI-2021-05931 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2020-12668 Improper authentication in Gallagher Command Centre CVSS 3.1CRITICAL 9.8
  • TI-2020-12666 Improper authorization in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2019-11404 An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). CVSS 3.0CRITICAL 9.8
  • TI-2021-05986 SQL injection in Gallagher Command Centre CVSS 3.1CRITICAL 9.9
  • TI-2020-12673 Incorrect type conversion in Gallagher Command Centre CVSS 3.1HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences