CVE-2026-20801

MediumCVSS 5.6/10Last modified Aug 17, 2026

Description

Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams.

This issue affects all versions of Gallagher NxWitness VMS integration prior to 9.10.017 and Gallagher Hanwha VMS integration prior to 9.10.025.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Mar 3, 2026
Last modified
Aug 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-208037.2Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-208047.7Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.CVE-2026-208055.5Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information CVE-2026-208065.5Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally.CVE-2026-208087.0Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorizCVE-2026-208097.8Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.CVE-2026-20817.2A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. ThisCVE-2026-208107.8Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-208117.8Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges CVE-2026-208126.5Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a CVE-2026-208147.0Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attackerCVE-2026-208157.0Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc)
CVE-2026-20801: Medium severity, CVSS 5.6 | Vulnix