ByteOS Network

CVE Vulnerability Details :

CVE-2025-2776

PUBLISHED

Known KEV

More Info Official Page

Assigner-VulnCheck

Assigner Org ID-83251b91-4cc7-4094-a5c7-464a1b83ea10

View Known Exploited Vulnerability (KEV) details

Published At-07 May, 2025 | 14:50

Updated At-30 Jul, 2025 | 01:36

▼CVE Numbering Authority (CNA)

SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Affected Products

Vendor

SysAid Technologies Ltd.

Product

SysAid On-Prem

Modules

serverurl

Default Status

affected

Versions

Affected

From 0 through 23.3.40 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-611	CWE-611 Improper Restriction of XML External Entity Reference

Metrics

Version	Base score	Base severity	Vector
3.1	9.3	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Impacts

CAPEC ID	Description
CAPEC-250	CAPEC-250 XML Injection

Credits

finder

Sina Kheirkhah (@SinSinology)

finder

Jake Knott

sponsor

watchTowr

References

Hyperlink	Resource
https://documentation.sysaid.com/docs/24-40-60	vendor-advisory
https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/	exploit

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

kev

dateAdded:

2025-07-22

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776

Timeline

Event	Date
CVE-2025-2776 added to CISA KEV	2025-07-22 00:00:00

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References