CVE-2025-52578

{"id": "CVE-2025-52578", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "disclosures@gallagher.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.5}]}, "published": "2025-11-18T04:15:44.330", "references": [{"url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578", "source": "disclosures@gallagher.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosures@gallagher.com", "description": [{"lang": "en", "value": "CWE-335"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM\u00a0may\u00a0allow a sophisticated attacker with physical access, to compromise internal device communications.\n\nThis issue affects Command Centre Server: \n\n9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)),\u00a0all versions of 9.00 and prior."}], "lastModified": "2025-11-18T14:06:29.817", "sourceIdentifier": "disclosures@gallagher.com"}