CVE-2025-2777
Published: 07 May 2025
Summary
CVE-2025-2777 is a critical-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Sysaid Sysaid. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SysAid On-Prem versions 23.3.40 and earlier are affected by an unauthenticated XML External Entity vulnerability in the lshw processing functionality. The flaw is tracked as CVE-2025-2777 with CWE-611 and carries a CVSS 3.1 score of 9.3 reflecting network attack vector, low complexity, no required privileges or user interaction, and impacts on confidentiality and availability.
Remote unauthenticated attackers can submit malicious XML to the affected component and leverage the XXE condition to achieve administrator account takeover along with arbitrary file read primitives on the server.
Vendor guidance and remediation details are published in the SysAid release documentation at https://documentation.sysaid.com/docs/24-40-60, while technical analysis of the issue appears in reporting from Watchtowr Labs. The associated EPSS score has remained in the 0.23 range without a material increase from a low baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13877
Vulnerability details
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
- CWE(s)
Related Threats
Threat-Actor AttributionAI
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.