CVE-2025-52578

MEDIUM5.7

Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications

Published Nov 18, 2025

Modified 3 months ago

Details

Incorrect Usage of Seeds in Pseudo-Random Number Generator (CWE- 335) vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications.

This issue affects Command Centre Server:

9.30 prior to vCR9.30.251028a (distributed in 9.30.2881 (MR3)), 9.20 prior to vCR9.20.251028a (distributed in 9.20.3265 (MR5)), 9.10 prior to vCR9.10.251028a (distributed in 9.10.4135 (MR8)), all versions of 9.00 and prior.

References

WEB

https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-52578

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-52578

CVSS Analysis

CVSS v3.1

5.7

Exploitability

Attack Vector

PhysicalAV:P

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

5.7/CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

Other

CWE-335

Ecosystems

Timeline

PublishedNov 18, 2025

ModifiedNov 19, 2025