CVE-2020-16097

On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed in v8.10.1211(MR5)), v8.00 prior to vGR8.00.165 (Distributed in v8.00.1228(MR6)), v7.90 prior to vGR7.90.165 (distributed in v7.90.1038(MRX)), v7.80 or earlier, It is possible to retrieve site keys used for securing MIFARE Plus and Desfire using debug ports on T Series readers.

CVSS v3 7.3 HIGH
CVSS v2.0 2.1 LOW

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.9 / Impact : 5.8

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://security.gallagher.com/Security-Advisories/CVE-2020-16097	Vendor Advisory
https://security.gallagher.com/Security-Advisories/CVE-2020-16097	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre::::::::
	cpe:2.3:a:gallagher:command_centre:7.90.1038:-::::::
	cpe:2.3:a:gallagher:command_centre:8.00.1228:-::::::
	cpe:2.3:a:gallagher:command_centre:8.10.1211:-::::::
	cpe:2.3:a:gallagher:command_centre:8.20.1093:-::::::

History

21 Nov 2024, 05:06

Type	Values Removed	Values Added
References	~~() https://security.gallagher.com/Security-Advisories/CVE-2020-16097 - Vendor Advisory~~	() https://security.gallagher.com/Security-Advisories/CVE-2020-16097 - Vendor Advisory
CVSS	v2 : ~~2.1~~ v3 : ~~4.6~~	v2 : 2.1 v3 : 7.3

Information

Published : 2020-09-15 14:15

Updated : 2024-11-21 05:06

NVD link : CVE-2020-16097

Mitre link : CVE-2020-16097

CVE.ORG link : CVE-2020-16097

JSON object : View

Products Affected

gallagher

command_centre

CWE

CWE-522

Insufficiently Protected Credentials

NVD-CWE-noinfo

{"id": "CVE-2020-16097", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosures@gallagher.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2020-09-15T14:15:13.753", "references": [{"url": "https://security.gallagher.com/Security-Advisories/CVE-2020-16097", "tags": ["Vendor Advisory"], "source": "disclosures@gallagher.com"}, {"url": "https://security.gallagher.com/Security-Advisories/CVE-2020-16097", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosures@gallagher.com", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "On controllers running versions of v8.20 prior to vCR8.20.200221b (distributed in v8.20.1093(MR2)), v8.10 prior to vGR8.10.179 (distributed in v8.10.1211(MR5)), v8.00 prior to vGR8.00.165 (Distributed in v8.00.1228(MR6)), v7.90 prior to vGR7.90.165 (distributed in v7.90.1038(MRX)), v7.80 or earlier, It is possible to retrieve site keys used for securing MIFARE Plus and Desfire using debug ports on T Series readers."}, {"lang": "es", "value": "En controladores que ejecutan versiones desde v8.20 anteriores a vCR8.20.200221b (distribuido en versi\u00f3n v8.20.1093(MR2)), versiones v8.10 anteriores a vGR8.10.179 (distribuido en versi\u00f3n v8.10.1211(MR5)), versiones v8.00 anteriores a vGR8 .00.165 (distribuido en versi\u00f3n v8.00.1228(MR6)), versiones v7.90 anteriores a vGR7.90.165 (distribuido en v7.90.1038(MRX)), versiones v7.80 o anteriores, es posible recuperar las claves del sitio usadas para proteger MIFARE Plus y Desfire por medio de puertos de depuraci\u00f3n en lectores de la Serie T"}], "lastModified": "2024-11-21T05:06:46.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF8D6403-45A4-42BD-AB15-AC90C5580356", "versionEndExcluding": "7.90.1038", "versionStartIncluding": "7.90"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AF24E0D-FEF8-4814-A689-50869362C70A", "versionEndExcluding": "8.00.1228", "versionStartIncluding": "8.00"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55BB8603-0AAE-49A3-B127-374F24C498DE", "versionEndExcluding": "8.10.1211", "versionStartIncluding": "8.10"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B4EE99E-7138-4228-8792-D4292507157F", "versionEndExcluding": "8.20.1093", "versionStartIncluding": "8.20"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:7.90.1038:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37CD3909-D0B6-4DC7-94EB-0C6F73E37172"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:8.00.1228:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5A79B43-E943-44E2-B13A-64F955518C8F"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:8.10.1211:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E672F2DB-6C4D-4549-977C-F4EDBCC461E3"}, {"criteria": "cpe:2.3:a:gallagher:command_centre:8.20.1093:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E4EBA1D-3F39-4FCA-B7A1-E28A65C1811F"}], "operator": "OR"}]}], "sourceIdentifier": "disclosures@gallagher.com"}