CVE-2025-52457
Medium
Description
Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.
SeverityMedium
CVSS5.7
Exploit probability—
ProductHBUS Devices
PublishedNov 18, 2025
First seenNov 18, 2025
Weakness typeCWE-208CWE-208
How to fix
Update
- Gallagher HBUS DevicesvCR9.30.251028a, vCR9.20.251028a, vCR9.10.251028a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Gallagher HBUS Devices | v ≤ 9.00, 9.30 ≤ v < vCR9.30.251028a, 9.20 ≤ v < vCR9.20.251028a, 9.10 ≤ v < vCR9.10.251028a | vCR9.30.251028a, vCR9.20.251028a, vCR9.10.251028a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.