CVE-2025-52457

Observable Timing Discrepancy (CWE-208) in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

CVSS 3.1

5.7CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-25)

CWE

CWE-208

Published

2025-11-18

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

References

• https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52457

Check your stackJSON