CVE-2025-64734

Executive Summary

CVE-2025-64734 is a denial-of-service (DoS) vulnerability affecting Gallagher T21 Readers when used with specific versions of the Command Centre Server. The flaw, classified as CWE-772 (Missing Release of Resource after Effective Lifetime), allows an attacker with physical access to the reader to exhaust system resources, preventing legitimate cardholders from badging for entry. The vulnerability has a low CVSS score of 2.4 due to the requirement for physical access and the localized impact on a single reader. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. The vendor, Gallagher, has released patches for supported versions of the Command Centre Server.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary physical access control system (PACS) from Gallagher, specifically the T21 Reader and Command Centre Server software. The supply chain risk is limited to organizations that deploy Gallagher hardware and software, and the patch must be applied through official vendor channels.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Physical (AV:P) – The attacker must have physical access to the T21 Reader.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required to exploit the vulnerability.
• Privileges Required (PR): None (PR:N) – No authentication is needed.
• User Interaction (UI): None (UI:N) – The attack does not require any action from a user.
• Scope (S): Unchanged (S:U) – The vulnerability affects only the targeted reader.
• Confidentiality (C): None (C:N) – No data is exposed.
• Integrity (I): None (I:N) – No data is modified.
• Availability (A): Low (A:L) – The reader becomes unavailable for badge entry, but the impact is localized.

Threat Level: Low. Exploitation requires physical access, and the impact is limited to a single reader. However, in high-security environments, a DoS on a reader could be used as a diversion or to bypass physical security controls.

Deep Dive & Mechanics

The vulnerability resides in the T21 Reader's firmware or its interaction with the Command Centre Server. The CWE-772 (Missing Release of Resource after Effective Lifetime) indicates that the reader fails to properly release a resource (e.g., memory, file handle, or network connection) after it has been used. An attacker with physical access can repeatedly trigger the resource allocation without triggering its release, leading to resource exhaustion.

Attack Scenario:

1. The attacker gains physical access to the T21 Reader (e.g., in a public area or through social engineering).
2. The attacker performs a specific sequence of actions (e.g., rapidly presenting invalid credentials, manipulating the reader's interface, or sending malformed data via the reader's communication port).
3. Each action causes the reader to allocate a resource (e.g., a session object or a memory buffer) that is not properly freed.
4. Over time, the reader's resources are exhausted, causing it to become unresponsive or crash.
5. Legitimate cardholders are unable to badge for entry, resulting in a denial of service.

The vulnerability is triggered by physical interaction, not network-based attacks. The Command Centre Server versions listed are affected because they may not properly handle resource cleanup on the reader side, or the reader firmware itself has the flaw. The patch updates the Command Centre Server to include a fix that ensures resources are released correctly.

Vulnerable vs. Patched Code

Since no source code is publicly available, the following is a conceptual example of the vulnerability and fix.

Vulnerable Code (Conceptual C/C++):

void process_badge_request() {
    // Allocate a session object
    Session *session = malloc(sizeof(Session));
    if (session == NULL) {
        return;
    }
    // Process the badge request
    if (!validate_badge(session)) {
        // Error handling but no free of session
        return;
    }
    // ... more processing ...
    // Missing: free(session);
}

Patched Code (Conceptual C/C++):

void process_badge_request() {
    Session *session = malloc(sizeof(Session));
    if (session == NULL) {
        return;
    }
    if (!validate_badge(session)) {
        free(session);  // Properly release resource on error
        return;
    }
    // ... more processing ...
    free(session);  // Release resource after use
}

The fix ensures that the allocated resource is freed in all code paths, preventing resource exhaustion.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Physical access to a Gallagher T21 Reader connected to a vulnerable Command Centre Server.
• No special tools required; the attack can be performed manually.

Exploitation Steps:

1. Identify a target T21 Reader in a controlled environment.
2. Repeatedly present invalid credentials (e.g., swipe a non-existent card) or perform a specific physical action (e.g., press the reader's button rapidly) that triggers resource allocation.
3. Monitor the reader's behavior. After a certain number of attempts, the reader should become unresponsive or display an error.
4. Verify that legitimate cardholders cannot badge for entry.

Note: No public exploit code is available. The attack is based on the CWE description and requires physical access.

Blue Team (Defensive)

Detection:

• Monitor reader logs for repeated failed authentication attempts or unusual physical interactions.
• Use network monitoring to detect anomalies in communication between the reader and the Command Centre Server (e.g., excessive session creation).
• Implement physical security controls to prevent unauthorized access to readers (e.g., tamper alarms, CCTV).

Mitigation:

• Apply the vendor patch to the Command Centre Server.
• Restrict physical access to readers to authorized personnel only.
• Implement rate limiting on the reader to prevent rapid resource allocation.
• Regularly audit reader logs for signs of resource exhaustion.

Indicators of Compromise (IOCs)

• Physical: Unusual behavior of the T21 Reader (e.g., unresponsive, error messages, LED patterns).
• Logs: Repeated failed badge attempts from the same physical location in a short period.
• Network: Excessive session establishment or resource allocation requests from the reader to the Command Centre Server.
• System: High memory or CPU usage on the reader (if accessible via management interface).

Detection Engineering

YARA Rule

rule CVE_2025_64734_T21_Reader_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2025-64734 via resource exhaustion patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64734"
    strings:
        $s1 = "resource allocation failed" nocase
        $s2 = "session timeout" nocase
        $s3 = "out of memory" nocase
    condition:
        any of them
}

Sigma Rule

title: Gallagher T21 Reader Resource Exhaustion
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects repeated failed badge attempts that may indicate exploitation of CVE-2025-64734
author: Valters IT
date: 2025-04-10
logsource:
    product: gallagher
    service: command_centre
detection:
    selection:
        EventID: 4625  # Failed logon (badge attempt)
        Count: 100     # Threshold for repeated attempts
    timeframe: 5m
    condition: selection
falsepositives:
    - Legitimate users with forgotten badges
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-64734 Gallagher T21 Reader DoS Attempt"; flow:to_server; content:"|00|"; threshold: type both, track by_src, count 100, seconds 300; sid:1000001; rev:1;)

Note: The Suricata rule is a placeholder and may need adjustment based on actual network traffic patterns.

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Command Centre Server to the patched versions:
   • 9.30.2881 (MR3) or later
   • 9.20.3265 (MR5) or later
   • 9.10.4135 (MR8) or later
2. For versions 9.00 and prior, upgrade to a supported version.

Long-Term Mitigations:

• Implement physical security controls to prevent unauthorized access to readers.
• Enable logging and monitoring for reader events.
• Conduct regular security assessments of physical access control systems.
• Follow vendor security advisories and apply patches promptly.

Workarounds:

• If patching is not immediately possible, restrict physical access to readers and monitor for unusual activity.
• Consider replacing T21 Readers with newer models if the vulnerability is not addressed in firmware updates.

Valters IT
Securing Your Digital Frontier