CVE-2020-16101

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-15 · updated 2026-06-17
Weakness: CWE-805

Description

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service due to an out-of-bounds buffer access. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier.

Affected products

Gallagher Command Centre: from 8.00 before 8.00.1228; from 8.10 before 8.10.1211; from 8.20 before 8.20.1166; 8.00.1228, 8.10.1211, 8.20.1166 — fixed in 8.00.1228, 8.10.1211, 8.20.1166

How to fix

Upgrade to a fixed version: Gallagher Command Centre 8.00.1228, 8.10.1211, 8.20.1166. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-16101 or the next vulnerability affects your stack