VulnerabilityDeferred

CVE-2025-52457

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security.

MEDIUM 5.7EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

CVSS 3.1: 5.7 MEDIUMCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.15% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-208
Source: disclosures@gallagher.com

References

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.