CVE-2020-16099: 
Gallagher Command Centre vulnerability analysis and mitigation

In Gallagher Command Centre v8.20 prior to v8.20.1093(MR2), a vulnerability was discovered that allows creation of Guard Tour events which can cause clients to temporarily hang or disconnect when accessed through reporting features. The vulnerability was disclosed on September 15, 2020 and assigned a medium severity rating with CVSS score indicating network vector, low privilege requirement, and low availability impact (Gallagher Security, AttackerKB).

The vulnerability is classified as CWE-20 (Improper Input Validation) according to the NVD classification. It affects the Guard Tour functionality in Gallagher Command Centre when accessed through reporting features. The CVSS v3.1 scoring metrics are: Attack Vector: Network (N), Attack Complexity: Low (L), Privileges Required: Low (PR), User Interaction: None (N), Scope: Unchanged (U), Confidentiality: None (C), Integrity: None (I), Availability: Low (A) (NVD CNA Status).

When exploited, this vulnerability can cause Command Centre clients to temporarily hang or disconnect when accessing Guard Tour events through reporting features. The impact is limited to availability and requires low-level privileges to exploit (Gallagher Security).

The vulnerability requires low privileges to exploit and can only be triggered if Guard Tours are present in the system. There is no known active exploitation of this vulnerability in the wild (Gallagher Security).

Gallagher has released maintenance release v8.20.1093(MR2) to address this vulnerability. Users are advised to upgrade their Command Centre server to this version. The upgrade requires the Command Centre server to be updated (Gallagher Security).