description: It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket (Configuration Client) connections. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier.
problem types: CWE-404 Improper Resource Shutdown or Release
affected:
{
product: Command Centre
vendor: Gallagher
versions:
lessThanOrEqual: 7.90, status: affected, version: unspecified, versionType: custom
lessThan: 8.20.1166 (MR3), status: affected, version: 8.20, versionType: custom
lessThan: 8.10.1211 (MR5), status: affected, version: 8.10, versionType: custom
lessThan: 8.00.1228 (MR6), status: affected, version: 8.00, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]