« Volver al listado

CVE-2025-44003

Estado: AplazadaMedia (4.3)—

Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled.

This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a (distributed in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distributed in  vEL9.00.3371 (MR7)),  all versions of 8.90 and prior.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Gallagher — T-series ReaderAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-44003",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-44003",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-10T13:11:06.416095Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosures@gallagher.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "disclosures@gallagher.com",
      "affectedData": [
        {
          "vendor": "Gallagher",
          "product": "T-Series Readers",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "8.90"
            },
            {
              "status": "affected",
              "version": "9.20",
              "lessThan": "vCR9.20.250213a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.10",
              "lessThan": "vCR9.10.250213a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.00",
              "lessThan": "vCR9.00.250619a",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-10T03:15:28.880",
  "references": [
    {
      "url": "https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-44003",
      "source": "disclosures@gallagher.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosures@gallagher.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-772"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled.\n\nThis issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a (distributed in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distributed in  vEL9.00.3371 (MR7)),  all versions of 8.90 and prior."
    },
    {
      "lang": "es",
      "value": "La falta de liberación de recursos tras el tiempo de vida útil (CWE-772) en el lector Gallagher Serie T permite a un atacante con acceso físico al lector realizar una denegación de servicio limitada cuando la tecnología de tarjeta de 125 kHz está habilitada. Este problema afecta a los lectores Serie T: versiones 9.20 anteriores a vCR9.20.250213a (distribuida en 9.20.1827 (MR2)), versiones 9.10 anteriores a vCR9.10.250213a (distribuida en 9.10.2692 (MR5)), versiones 9.00 anteriores a vCR9.00.250619a (distribuida en vEL9.00.3371 (MR7)), y todas las versiones de 8.90 y anteriores."
    }
  ],
  "lastModified": "2026-06-17T09:24:53.970",
  "sourceIdentifier": "disclosures@gallagher.com"
}