CVE-2025-64734
📋 TL;DR
A resource management vulnerability (CWE-772) in Gallagher Command Centre T21 Reader allows attackers with physical access to cause a denial-of-service, preventing cardholders from using the reader for entry. This affects Command Centre Server versions 9.30, 9.20, 9.10, and all versions of 9.00 and earlier. The vulnerability requires physical access to the reader device.
💻 Affected Systems
- Gallagher Command Centre Server
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Physical attacker permanently disables a T21 Reader, requiring hardware replacement and preventing all badge-based access through that reader until resolved.
Likely Case
Physical attacker temporarily disables a T21 Reader, requiring manual reboot or maintenance intervention to restore functionality.
If Mitigated
With proper physical security controls preventing unauthorized access to readers, impact is minimal to none.
🎯 Exploit Status
Exploitation requires physical interaction with the T21 Reader hardware. No network-based exploitation is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vCR9.30.251028a (in 9.30.2881 MR3), vCR9.20.251028a (in 9.20.3265 MR5), vCR9.10.251028a (in 9.10.4135 MR8)
Vendor Advisory: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-64734
Restart Required: Yes
Instructions:
1. Download appropriate patch from Gallagher support portal. 2. Apply patch to Command Centre Server. 3. Restart Command Centre Server services. 4. Verify T21 Readers reconnect and function normally.
🔧 Temporary Workarounds
Physical Security Enhancement
allStrengthen physical security around T21 Readers to prevent unauthorized access
Reader Monitoring
allImplement monitoring for T21 Reader status and alert on reader disconnections
🧯 If You Can't Patch
- Implement strict physical access controls to prevent unauthorized personnel from accessing T21 Readers
- Establish rapid response procedures for reader failures including manual reboot procedures
🔍 How to Verify
Check if Vulnerable:
Check Command Centre Server version in Gallagher Command Centre interface. If version is 9.30 prior to 9.30.2881 MR3, 9.20 prior to 9.20.3265 MR5, 9.10 prior to 9.10.4135 MR8, or any 9.00 version, system is vulnerable.Check Version:
Check version in Gallagher Command Centre web interface under Help > About or via server consoleVerify Fix Applied:
Verify Command Centre Server version shows patched version (9.30.2881 MR3, 9.20.3265 MR5, or 9.10.4135 MR8) and all T21 Readers are functioning normally.📡 Detection & Monitoring
Log Indicators:
- T21 Reader disconnection events
- Reader communication failures
- Unexpected reader reboots
Network Indicators:
- Loss of communication with specific T21 Readers
SIEM Query:
source="gallagher_command_centre" AND (event_type="reader_disconnect" OR event_type="reader_error") AND reader_model="T21"