CVE-2020-16098: 
Gallagher Command Centre vulnerability analysis and mitigation

CVE-2020-16098 is a critical vulnerability affecting Gallagher Command Centre Server that was discovered in 2020. The vulnerability affects multiple versions including Command Centre v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), and all versions of v7.90 and earlier. Additionally, v8.30 versions prior to v8.30.1236 MR1 are affected when using the legacy 'Smart Card Login' feature or if any workstations are not using client authentication (Vendor Advisory).

The vulnerability has been assigned a Critical severity rating with a CVSS v3.1 base score of 9.8 (CRITICAL) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and CWE-287 (Improper Authentication). The technical issue allows for the enumeration of access card credentials through an unauthenticated network connection to the server (NVD).

If exploited, the vulnerability allows attackers to enumerate access card credentials through an unauthenticated network connection. These obtained credentials can then be used to encode low security cards that could be accepted by the system where insecure card technologies are supported (Vendor Advisory).

The vulnerability requires a network route between the attacker and the server for exploitation. As of the advisory publication, there has been no active exploitation of this vulnerability reported in the wild (Vendor Advisory).

Several mitigation strategies have been provided: 1) Disabling 'Smart Card Login' on all workstations reduces the severity to High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), 2) Ensuring readers only accept secure card technologies and having Smart Card Login disabled reduces severity to Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), 3) For v8.30, ensuring all workstations use client authentication and have 'Smart Card Login' disabled completely mitigates the vulnerability. Maintenance releases are available: v8.30.1236(MR1), v8.20.1166(MR3), v8.10.1211(MR5), and v8.00.1228(MR6) (Vendor Advisory).