CVE-2025-44003

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-10 · updated 2026-06-17
Weakness: CWE-772

Description

Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled. This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a (distributed in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distributed in vEL9.00.3371 (MR7)), all versions of 8.90 and prior.

Affected products

Gallagher T-Series Readers: through 8.90; from 9.20 before vCR9.20.250213a; from 9.10 before vCR9.10.250213a; from 9.00 before vCR9.00.250619a — fixed in vCR9.00.250619a, vCR9.10.250213a, vCR9.20.250213a

How to fix

Upgrade to a fixed version: Gallagher T-Series Readers vCR9.00.250619a, vCR9.10.250213a, vCR9.20.250213a. Check the vendor advisory for mitigations.

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-44003

Get alerted when CVE-2025-44003 or the next vulnerability affects your stack