CVE-2025-52457

State: Published
Severity: 5.7 Medium
Published: Nov 18, 2025
Updated: Nov 19, 2025
Reserved: Jun 17, 2025

Description

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security.

This issue affects Command Centre Server:

9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

Scores

CVSS	Score	Vector	Source
3.1	5.7 Medium	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	Gallagher

Weaknesses

CWE-208 Observable Timing Discrepancy

Affected Products

Product	Versions
HBUS DevicesGallagher	9.00 and earlierAffected 9.30 to before vCR9.30.251028aAffected 9.20 to before vCR9.20.251028aAffected 9.10 to before vCR9.10.251028aAffected

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.