CyberSec.Space Logo
Back to CVE Browser

CVE-2025-2777

CRITICAL
9.3
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-05-07
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.

Affected Platforms (CPE)

📦
Sysaid

Sysaid

<= 23.3.40

References & Advisories

🔗 https://documentation.sysaid.com/docs/24-40-60
🔗 https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
🔗 https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/

Related Vulnerabilities

CVE-2025-27769.3

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL ...

CVE-2025-27759.3

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin pro...

CVE-2024-363949.1

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE-2024-363939.9

SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')