What is the CVSS score of CVE-2025-61479?

CVE-2025-61479 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Acre Security SPC5300 are affected by CVE-2025-61479?

Acre Security's SPC5300.000 access-control panel contains a replay attack vulnerability that could disrupt facility access-control operations through denial of service.

How to fix or mitigate CVE-2025-61479?

Within 24 hours, identify all SPC5300.000 installations in your environment and audit network segmentation around SPC Connect Pro systems; enable detailed logging of TCP session activity on access-control infrastructure. Within 7 days, contact Acre Security technical support to confirm whether firmware updates or configuration hardening options exist; implement network access controls to restrict physical proximity connectivity to the access-control panel; and establish monitoring for unusual TCP session terminations or suspicious payload patterns. Within 30 days, evaluate whether redundant or offline backup access mechanisms (emergency card readers, manual override procedures) can supplement the primary system; assess long-term patching roadmaps and consider network architecture changes that further isolate access-control infrastructure from untrusted network segments.

Acre Security SPC5300 CVE-2025-61479

EUVD-2025-210803 HIGH

Authentication Bypass by Capture-replay (CWE-294)

2026-08-26 mitre

GHSA-577q-xx28-qxgp

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Description states physically proximate attacker injecting into local TCP session, so AV:A overrides the NVD AV:N; impact is availability-only DoS with no confidentiality or integrity effect.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 22:43 vuln.today

CVSS changed

Aug 27, 2026 - 20:37 NVD

7.5 (HIGH)

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 26, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session.

AnalysisAI

Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.

Technical ContextAI

The SPC5300.000 is a security panel controller (SPC) manufactured by Vanderbilt Industries and marketed under the Acre Security brand, used in commercial building access control and intrusion alarm systems. SPC Connect Pro is the application software that communicates with the panel over TCP. CWE-294 (Authentication Bypass by Capture-Replay) identifies the root cause: the application-layer protocol does not include sufficient anti-replay protections such as nonces, sequence numbers, or session-bound message authentication codes. An attacker who can observe or capture valid TCP session payloads can retransmit them verbatim to trigger unintended panel behavior. CPE data provided is non-specific (n/a), so affected scope is confirmed only from the CVE description: SPC5300.000 Main Board firmware v.3.14.1.

RemediationAI

No vendor-released patch has been identified at time of analysis; no fixed firmware version is referenced in available sources. Compensating controls should be applied immediately: network-segment the SPC5300 panels and SPC Connect Pro hosts onto dedicated VLANs inaccessible from general corporate or guest networks, reducing the attacker's ability to intercept or inject TCP session traffic. Enforce physical access controls to network ports and cabling in areas where the panel communicates, limiting the 'physically proximate' prerequisite. Monitor TCP sessions to SPC panels for anomalous retransmission patterns or unexpected payload repetition using network detection tools. Contact Acre Security (https://www.acresecurity.com) directly for firmware update availability and vendor guidance on this CVE. Refer to the SIKT advisory at https://nva.sikt.no/registration/019c9145712a-8c458dda-4473-488c-9a20-b9e8938f24d5 for any updated remediation guidance.