CVE-2025-52578

Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.2

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de uso incorrecto de semillas en el generador de números pseudoaleatorios (CWE-335) en el High Sec ELM puede permitir a un atacante sofisticado con acceso físico comprometer las comunicaciones internas del dispositivo. Este problema afecta al Command Centre Server: Versiones 9.30 anteriores a vCR9.30.251028a (distribuido en 9.30.2881 (MR3)), Versiones 9.20 anteriores a vCR9.20.251028a (distribuido en 9.20.3265 (MR5)), Versiones 9.10 anteriores a vCR9.10.251028a (distribuido en 9.10.4135 (MR8)), todas las versiones de 9.00 y anteriores.

Information

Published : 2025-11-18 04:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-52578

Mitre link : CVE-2025-52578

CVE.ORG link : CVE-2025-52578

JSON object : View

Products Affected

No product.

CWE

CWE-335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2025-52578", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52578", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-18T15:04:03.417918Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosures@gallagher.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.5}]}, "affected": [{"source": "disclosures@gallagher.com", "affectedData": [{"vendor": "Gallagher", "product": "High Sec End of Line Module", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "9.00"}, {"status": "affected", "version": "9.30", "lessThan": "vCR9.30.251028a", "versionType": "custom"}, {"status": "affected", "version": "9.20", "lessThan": "vCR9.20.251028a", "versionType": "custom"}, {"status": "affected", "version": "9.10", "lessThan": "vCR9.10.251028a", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-18T04:15:44.330", "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578", "source": "disclosures@gallagher.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosures@gallagher.com", "description": [{"lang": "en", "value": "CWE-335"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM\u00a0may\u00a0allow a sophisticated attacker with physical access, to compromise internal device communications.\n\nThis issue affects Command Centre Server: \n\n9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)),\u00a0all versions of 9.00 and prior."}, {"lang": "es", "value": "La vulnerabilidad de uso incorrecto de semillas en el generador de n\u00fameros pseudoaleatorios (CWE-335) en el High Sec ELM puede permitir a un atacante sofisticado con acceso f\u00edsico comprometer las comunicaciones internas del dispositivo.\n\nEste problema afecta al Command Centre Server:\n\nVersiones 9.30 anteriores a vCR9.30.251028a (distribuido en 9.30.2881 (MR3)), Versiones 9.20 anteriores a vCR9.20.251028a (distribuido en 9.20.3265 (MR5)), Versiones 9.10 anteriores a vCR9.10.251028a (distribuido en 9.10.4135 (MR8)), todas las versiones de 9.00 y anteriores."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "disclosures@gallagher.com"}