PT-2025-39176 · Wso2 · Wso2 Products

Noël Maccary · Published 2025-09-23 · Updated 2025-11-21 · CVE-2025-5717

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description An authenticated remote code execution (RCE) issue exists due to improper input validation in the event processor admin service. An attacker with administrative access to the SOAP admin services can deploy a Siddhi execution plan containing malicious Java code, leading to arbitrary code execution on the server. Exploitation requires a valid user account with administrative privileges. The vulnerable component is the event processor admin service, specifically when handling Siddhi execution plans. The API endpoint used for deployment is the SOAP admin service. The vulnerability lies in the improper validation of input within the Siddhi execution plan, allowing malicious Java code to be injected and executed. The variable execution plan within the SOAP request is susceptible to this flaw. The function deployExecutionPlan() is involved in processing the Siddhi execution plan.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-5717

Affected Products

Wso2 Products

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-5717 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5717 · Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119 · Vendor Advisory
• https://twitter.com/SecAideInfo/status/1971518738886242757 · Twitter Post
• https://t.me/cveNotify/141134 · Telegram Post
• https://twitter.com/CVEnew/status/1970621805963682189 · Twitter Post
• https://t.me/cveNotify/143666 · Telegram Post