CVE-2025-52457

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-18 · updated 2026-10-18
Weakness: CWE-208

Description

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

Affected products

Gallagher HBUS Devices: through 9.00; from 9.30 before vCR9.30.251028a; from 9.20 before vCR9.20.251028a; from 9.10 before vCR9.10.251028a — fixed in vCR9.10.251028a, vCR9.20.251028a, vCR9.30.251028a

How to fix

Upgrade to a fixed version: Gallagher HBUS Devices vCR9.10.251028a, vCR9.20.251028a, vCR9.30.251028a. Check the vendor advisory for mitigations.

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457

Get alerted when CVE-2025-52457 or the next vulnerability affects your stack