CVE-2025-44003

Executive Summary

CVE-2025-44003 is a denial-of-service vulnerability in Gallagher T-Series Readers, specifically affecting the 125 kHz card technology subsystem. The flaw is a Missing Release of Resource after Effective Lifetime (CWE-772), meaning the reader fails to properly release system resources (e.g., memory, file handles, or hardware locks) after processing a 125 kHz card transaction. An attacker with physical access to the reader can repeatedly present a 125 kHz card (or a compatible device) to exhaust the reader’s resources, causing it to become unresponsive or crash. This results in a limited denial of service, preventing legitimate cardholders from using the reader until it is manually reset or the resource leak is cleared.

The vulnerability affects all T-Series Reader firmware versions prior to the specified patched releases. The CVSS score is 4.3 (Medium), with a physical attack vector and low complexity. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating very low exploitation activity in the wild. However, given the physical access requirement, the primary risk is to high-security environments where physical security perimeters are already in place.

Supply Chain & Package Security

This vulnerability is not related to software supply chain or package management. It is a firmware-level issue in embedded hardware readers. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Physical – The attacker must have physical access to the reader.
• Attack Complexity (AC): Low – No special conditions or mitigations are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The impact is confined to the reader itself.
• Confidentiality (C): None – No data exposure.
• Integrity (I): None – No data modification.
• Availability (A): Low – The reader becomes unavailable, but the impact is limited (single reader, not the entire system).

Threat Level: Low to Medium. The physical access requirement significantly reduces the attack surface. However, in environments where physical access is possible (e.g., unsecured lobbies, parking gates), an attacker could disrupt access control for a specific door.

Deep Dive & Mechanics

The vulnerability resides in the 125 kHz card technology handler within the Gallagher T-Series Reader firmware. When a 125 kHz card is presented, the reader allocates resources (e.g., memory buffers, hardware timers, or communication channels) to process the transaction. Due to a programming error, these resources are not properly released after the transaction completes or fails. Over time, repeated presentations of 125 kHz cards cause resource exhaustion, leading to a denial-of-service condition.

Root Cause: The release_resources() function (or equivalent) is not called after processing a 125 kHz card, or it is called conditionally only for certain card types. The code path for 125 kHz cards lacks the necessary cleanup logic.

Attack Scenario:

1. Attacker gains physical proximity to a Gallagher T-Series Reader.
2. Attacker repeatedly presents a 125 kHz card (or a compatible device like a Proxmark3) to the reader.
3. Each presentation consumes a small amount of system resources that are never freed.
4. After a certain number of presentations (e.g., 1000), the reader runs out of resources and stops responding.
5. The reader may require a power cycle or a hardware reset to recover.

Affected Components:

• Gallagher T-Series Readers (all models supporting 125 kHz)
• Firmware versions: 9.20 prior to vCR9.20.250213a, 9.10 prior to vCR9.10.250213a, 9.00 prior to vCR9.00.250619a, and all versions of 8.90 and prior.

Vulnerable vs. Patched Code

The following is a conceptual representation of the vulnerable and patched code. Actual firmware code is proprietary.

Vulnerable Code (C-like pseudocode):

void process_125kHz_card(CardData *card) {
    // Allocate resources
    Resource *res = allocate_resource();
    if (res == NULL) {
        log_error("Resource allocation failed");
        return;
    }
    // Process card
    if (validate_card(card)) {
        grant_access();
    } else {
        deny_access();
    }
    // BUG: Missing resource release
    // free_resource(res);  // This line is missing
}

Patched Code:

void process_125kHz_card(CardData *card) {
    // Allocate resources
    Resource *res = allocate_resource();
    if (res == NULL) {
        log_error("Resource allocation failed");
        return;
    }
    // Process card
    if (validate_card(card)) {
        grant_access();
    } else {
        deny_access();
    }
    // FIX: Properly release resources
    free_resource(res);
}

The patch adds a call to free_resource() (or equivalent) after the card processing is complete, ensuring that resources are always released regardless of the card validation outcome.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to a Gallagher T-Series Reader with 125 kHz enabled.
• A 125 kHz card or a programmable device (e.g., Proxmark3, HID iClass SE reader in emulation mode).

Exploitation Steps:

1. Identify a target reader (e.g., at a building entrance).
2. Configure a Proxmark3 to emulate a 125 kHz card (e.g., HID ProxCard II).
3. Write a script to repeatedly present the card to the reader (e.g., using a solenoid or motor to physically tap the reader).
4. Monitor the reader’s behavior (e.g., LED status, network connectivity).
5. After several hundred to a few thousand taps, the reader should become unresponsive.
6. The denial of service persists until the reader is power-cycled or reset.

Example Script (Python with Proxmark3):

import time
import proxmark3

pm3 = proxmark3.Proxmark3()
pm3.connect()

# Emulate a 125 kHz card
pm3.lf_hid_emulate(id=12345678)

for i in range(1000):
    pm3.lf_hid_sim()  # Simulate card presence
    time.sleep(0.1)   # Short delay between taps
    print(f"Tap {i+1}")

print("DoS attack completed. Reader should be unresponsive.")

Blue Team

Detection:

• Monitor reader logs for repeated 125 kHz card read attempts from the same card ID within a short time window.
• Set up network monitoring for ICMP unreachable or TCP connection failures to the reader.
• Use physical security cameras to detect suspicious behavior near readers.

Mitigation:

• Apply the firmware patch as soon as possible.
• Disable 125 kHz card technology if not required (use only 13.56 MHz or other technologies).
• Implement rate limiting on the reader side (if firmware allows).
• Use physical barriers to prevent repeated tapping (e.g., anti-passback, turnstiles).

Recovery:

• Power cycle the affected reader.
• If the reader does not recover, perform a factory reset and reapply the patched firmware.

Indicators of Compromise (IOCs)

• Network: Repeated failed authentication attempts from the same MAC address or IP (if the reader logs network events).
• Physical: Unusually high number of 125 kHz card reads in a short period (e.g., >100 reads per minute from the same card).
• System: Reader LED shows a solid red or off state (indicating unresponsive).
• Logs: Reader logs show repeated "125 kHz card read" events with no corresponding access grant or denial (if logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2025_44003_Gallagher_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2025-44003 via repeated 125 kHz card reads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44003"
    strings:
        $s1 = "125 kHz" nocase
        $s2 = "card read" nocase
        $s3 = "resource" nocase
    condition:
        all of them
}

Sigma Rule

title: Gallagher T-Series Reader DoS via 125 kHz Card
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects repeated 125 kHz card reads that may indicate CVE-2025-44003 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: gallagher
    service: reader
detection:
    selection:
        EventID: 125kHz_Card_Read
    condition: selection | count() by CardID > 100 within 60 seconds
falsepositives:
    - Legitimate high-traffic areas (e.g., turnstiles)
level: medium

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2025-44003 Gallagher Reader DoS Attempt"; flow:to_server; content:"125 kHz"; nocase; content:"card read"; nocase; threshold: type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch Firmware: Upgrade to the following patched versions:
   • 9.20: vCR9.20.250213a (distributed in 9.20.1827 MR2)
   • 9.10: vCR9.10.250213a (distributed in 9.10.2692 MR5)
   • 9.00: vCR9.00.250619a (distributed in vEL9.00.3371 MR7)
   • 8.90 and prior: Upgrade to a supported version (9.00 or later) and then apply the patch.
2. Disable 125 kHz: If 125 kHz card technology is not required, disable it in the reader configuration to eliminate the attack vector.
3. Physical Security: Install physical barriers (e.g., anti-passback, turnstiles) to prevent repeated tapping.

Long-Term Measures:

• Implement network segmentation for readers to limit lateral movement.
• Enable logging and monitoring for reader events.
• Conduct regular firmware audits and apply patches promptly.
• Consider migrating to 13.56 MHz (MIFARE/DESFire) or other more secure card technologies.

Workaround (if patching is not immediately possible):

• Reduce the reader’s resource allocation limits (if configurable) to minimize the impact of resource exhaustion.
• Implement a watchdog timer that automatically resets the reader if it becomes unresponsive.

Valters IT