Critical · published September 15, 2020
🚨 An unauthenticated network connection can expose access card credentials like an open book, allowing attackers to access sensitive areas. 🔥 Imagine a hotel where anyone can wander in and peek at the guest list without any checks. That's exactly what this flaw allows—unauthorized access to sensitive card credentials, making it far too easy for an attacker to create bogus access cards. In a worst-case scenario, attackers could create unauthorized access cards using the stolen credentials, potentially storming secure areas and causing absolutely devastating breaches. This could lead to unauthorized access to sensitive data or physical locations, putting your entire operation at risk!
Imagine a hotel where anyone can wander in and peek at the guest list without any checks. That's exactly what this flaw allows—unauthorized access to sensitive card credentials, making it far too easy for an attacker to create bogus access cards. CVE-2020-16098 allows attackers to enumerate access card credentials due to a lack of authentication on network connections to the Command Centre server. This flaw affects versions of Command Centre v8.20 before v8.20.1166(MR3), v8.10 before v8.10.1211(MR5), v8.00 before v8.00.1228(MR6), as well as all versions of 7.90 and earlier.
In a worst-case scenario, attackers could create unauthorized access cards using the stolen credentials, potentially storming secure areas and causing absolutely devastating breaches. This could lead to unauthorized access to sensitive data or physical locations, putting your entire operation at risk! Immediate action is required! Upgrade your Command Centre to versions 8.20.1166(MR3), 8.10.1211(MR5), or 8.00.1228(MR6) at the very least. Additionally, consider hardening your network access controls to prevent such vulnerabilities from arising in the future. 🛡️ You’ve got this! By taking these steps, you’ll be well on your way to securing your access control systems. 💪✨