CVE-2025-52457

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.2

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una Discrepancia de Tiempo Observable (CWE-208) en dispositivos HBUS puede permitir a un atacante con acceso físico al dispositivo extraer claves específicas del dispositivo, comprometiendo potencialmente la seguridad adicional del sitio. Este problema afecta a Command Centre Server: 9.30 Versiones anteriores a vCR9.30.251028a (distribuido en 9.30.2881 (MR3)), 9.20 Versiones anteriores a vCR9.20.251028a (distribuido en 9.20.3265 (MR5)), 9.10 Versiones anteriores a vCR9.10.251028a (distribuido en 9.10.4135 (MR8)), todas las versiones de 9.00 y anteriores.

Information

Published : 2025-11-18 04:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-52457

Mitre link : CVE-2025-52457

CVE.ORG link : CVE-2025-52457

JSON object : View

Products Affected

No product.

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2025-52457", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52457", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-18T15:04:04.821385Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosures@gallagher.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.5}]}, "affected": [{"source": "disclosures@gallagher.com", "affectedData": [{"vendor": "Gallagher", "product": "HBUS Devices", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "9.00"}, {"status": "affected", "version": "9.30", "lessThan": "vCR9.30.251028a", "versionType": "custom"}, {"status": "affected", "version": "9.20", "lessThan": "vCR9.20.251028a", "versionType": "custom"}, {"status": "affected", "version": "9.10", "lessThan": "vCR9.10.251028a", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-18T04:15:44.140", "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457", "source": "disclosures@gallagher.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosures@gallagher.com", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. \n\nThis issue affects Command Centre Server:\n\n9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)),\u00a0all versions of 9.00 and prior."}, {"lang": "es", "value": "Una Discrepancia de Tiempo Observable (CWE-208) en dispositivos HBUS puede permitir a un atacante con acceso f\u00edsico al dispositivo extraer claves espec\u00edficas del dispositivo, comprometiendo potencialmente la seguridad adicional del sitio.\n\nEste problema afecta a Command Centre Server:\n\n9.30 Versiones anteriores a vCR9.30.251028a (distribuido en 9.30.2881 (MR3)),\n9.20 Versiones anteriores a vCR9.20.251028a (distribuido en 9.20.3265 (MR5)),\n9.10 Versiones anteriores a vCR9.10.251028a (distribuido en 9.10.4135 (MR8)),\ntodas las versiones de 9.00 y anteriores."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "disclosures@gallagher.com"}