CVE-2020-16100: 
Gallagher Command Centre vulnerability analysis and mitigation

CVE-2020-16100 is a vulnerability in Gallagher Command Centre Server that was disclosed on September 15, 2020. The vulnerability affects multiple versions of the software including v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), and all versions of 7.90 and earlier (NVD, Gallagher Advisory).

The vulnerability is classified as an Improper Resource Shutdown or Release (CWE-404) issue. It allows an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability prevents the Command Centre service from accepting future DCOM websocket (Configuration Client) connections, effectively causing a denial of service condition (Gallagher Advisory).

There have been no reported instances of active exploitation of this vulnerability in the wild (Gallagher Advisory).

Gallagher has released maintenance updates to address this vulnerability: v8.20.1166(MR3), v8.10.1211(MR5), and v8.00.1228(MR6). As an additional mitigation measure, users are advised to configure the firewall on the Command Centre server machine to restrict access to the DCOM websocket port (8905), as recommended in the Hardening Guide (Gallagher Advisory).