CVE-2025-52457

MEDIUM

Command Centre Server <9.30.251028a - Info Disclosure

Title source: llm

Description

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

References (1)

[Various Sources] https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457

Scores

CVSS v3 5.7

EPSS 0.0002

EPSS Percentile 3.6%

Attack Vector PHYSICAL

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-208

Status published

Products (4)

Gallagher/HBUS Devices < 9.00

Gallagher/HBUS Devices 9.10 - vCR9.10.251028a

Gallagher/HBUS Devices 9.20 - vCR9.20.251028a

Gallagher/HBUS Devices 9.30 - vCR9.30.251028a

Published Nov 18, 2025

Tracked Since Feb 18, 2026