CVE-2025-2777

Published May 7, 2025

Last updated 2 months ago

SysAid On-Prem

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-2777 affects SysAid On-Prem versions up to and including 23.3.40. It is an unauthenticated XML External Entity (XXE) vulnerability found in the lshw processing functionality. This vulnerability allows for administrator account takeover and file read primitives.

Description: SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
Source: disclosure@vulncheck.com
NVD status: Analyzed
Products: sysaid

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

disclosure@vulncheck.com: CWE-611

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9F967FFC-8AE4-4215-B2F5-333870F75899",
            "versionEndIncluding": "23.3.40"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.