PT-2025-20233 · Sysaid · Sysaid On-Prem

Jake Knott + 2 · Published 2025-01-06 · Updated 2026-02-16 · CVE-2025-2777

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier

Description SysAid On-Prem software is affected by an unauthenticated XML External Entity (XXE) issue in the lshw processing functionality. Exploitation of this issue may allow a remote attacker to take control of administrator accounts and read files. The vulnerability resides in the doPost method of the com.ilient.agentApi.LshwAgent component when processing requests to the /lshw API endpoint. The issue involves improper restriction of XML references to external entities. The vulnerable parameter is not explicitly specified.

Recommendations SysAid On-Prem versions 23.3.40 and earlier should be updated to a newer, fixed version.

Exploit

Fix

RCE

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2025-06622

CVE-2025-2777

Affected Products

Sysaid On-Prem

References · 25

• 🔥 https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket · Exploit
• https://documentation.sysaid.com/docs/24-40-60 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2777 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06622 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2777 · Security Note
• https://twitter.com/pdnuclei_bot/status/1921248879053308220 · Twitter Post
• https://twitter.com/DarkWebInformer/status/1981414767668715765 · Twitter Post
• https://twitter.com/zoomeye_team/status/1948268124291342529 · Twitter Post
• https://twitter.com/ksg93rd/status/1922687016577237120 · Twitter Post
• https://t.me/true_secator/7023 · Telegram Post
• https://t.me/ckure/15565 · Telegram Post
• https://t.me/aptreports/26051 · Telegram Post
• https://twitter.com/syedaquib77/status/1920175042425761951 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1ofnsv0/top_10_trending_cves_25102025 · Reddit Post
• https://twitter.com/cybercronai/status/1920670135783665987 · Twitter Post