dbcve.org
Command CentreApplication · Gallagher

CVE-2019-19802

MEDIUM · 6.5 CVSS v3.1 Published 2020-01-17
Fix available
A fix is available. Upgrade to 7.70 / 7.80.960 or later.
See remediation →
71/100
Remediation priority · Elevated
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an authenticated user connecting to OPCUA can view all data that would be replicated in a multi-server setup without privilege checks being applied.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is an authorization bypass vulnerability in Gallagher Command Centre Server where authenticated OPCUA users can view all data that would be replicated in a multi-server setup. The issue stems from missing privilege checks being applied when users connect via OPCUA, allowing unauthorized access to sensitive data that should be restricted based on user permissions.

MitigationUpgrade to the patched version: v8.10.1134(MR4) or later, v8.00.1161(MR5) or later, v7.90.991(MR5) or later, or v7.80.960(MR2) or later. For v7.70 or earlier versions, upgrade to a supported patched version.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Command CentreApplication
Affected:< 7.70>= 7.80, < 7.80.960>= 7.90, < 7.90.991>= 8.00, < 8.00.1161>= 8.10, < 8.10.1134= 7.80.960= 7.90.991= 8.00.1161= 8.10.1134

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed Gallagher Command Centre version
    Run 'gcc --version' or check the Gallagher Command Centre Server About dialog in the application. On Windows, you may also check the installed program version via Control Panel > Programs and Features.
    Affected if The installed version falls within any of these ranges: < 7.70, >= 7.80 and < 7.80.960, >= 7.90 and < 7.90.991, >= 8.00 and < 8.00.1161, >= 8.10 and < 8.10.1134.
  2. Verify OPCUA interface is enabled
    Check the Gallagher Command Centre Server configuration for OPCUA settings. This is typically found in Server Admin > Hardware > Controllers > OPCUA or via the server configuration file (usually in the Command Centre installation directory under config or settings).
    Affected if The OPCUA interface is enabled and accessible on the server.
  3. Confirm multi-server replication is configured
    Inspect the Command Centre multi-server settings via Server Admin > Multi-Server or check the database configuration for replication settings. Look for configurations indicating data replication between multiple Command Centre servers.
    Affected if The environment uses or is configured to use multi-server replication or data synchronization between Gallagher Command Centre servers.
  4. Check OPCUA user authentication settings
    Review OPCUA client connection settings and authenticated users in Server Admin > Users > OPCUA Users or examine the OPCUA endpoint configuration for the authentication method in use.
    Affected if Users are connecting to the Command Centre Server via OPCUA protocol with authenticated access.

If the installed version is vulnerable AND OPCUA is enabled AND multi-server replication is configured, the environment is affected by this authorization bypass vulnerability.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Upgrade available Upgrade to 7.70 / 7.80.960 / 7.90.991 or later
Fixed in 7.707.80.9607.90.991
Interim mitigation

Upgrade to the patched version: v8.10.1134(MR4) or later, v8.00.1161(MR5) or later, v7.90.991(MR5) or later, or v7.80.960(MR2) or later. For v7.70 or earlier versions, upgrade to a supported patched version.

Fix this in Command Centre Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2019-19802 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2019-19802 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data