CVE-2025-52578

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-18 · updated 2026-10-18
Weakness: CWE-335

Description

Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

Affected products

Gallagher High Sec End of Line Module: through 9.00; from 9.30 before vCR9.30.251028a; from 9.20 before vCR9.20.251028a; from 9.10 before vCR9.10.251028a — fixed in vCR9.10.251028a, vCR9.20.251028a, vCR9.30.251028a

How to fix

Upgrade to a fixed version: Gallagher High Sec End of Line Module vCR9.10.251028a, vCR9.20.251028a, vCR9.30.251028a. Check the vendor advisory for mitigations.

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578

Get alerted when CVE-2025-52578 or the next vulnerability affects your stack