PT-2025-43554 · Bae Systems · Socet Gxp+1

Published 2025-10-23 · Updated 2025-11-18 · CVE-2025-54963

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BAE SOCET GXP versions prior to 4.6.0.2

Description An issue exists where an attacker interacting with the GXP Job Service can submit a crafted job request to gain read access to files on the filesystem, using the permissions of the GXP Job Service process. The application does not sanitize the file path for directory traversal, which could allow an attacker to read sensitive files in certain setups. The vulnerable component is the GXP Job Service. The path to a file is not sanitized, potentially allowing an attacker to read sensitive files.

Recommendations Update to version 4.6.0.2 or later.

Fix

Out of bounds Read

Path traversal

Weakness Enumeration

CWE-125

CWE-22

Related Identifiers

CVE-2025-54963

Affected Products

Gxp Job Service

Socet Gxp

References · 7

• https://osv.dev/vulnerability/CVE-2025-54963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54963 · Security Note
• https://geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54963 · Vendor Advisory
• https://baesystems.com/en-us/product/geospatial-exploitation-products · Note
• https://twitter.com/VulmonFeeds/status/1981556075963822476 · Twitter Post
• https://t.me/CVEtracker/35605 · Telegram Post
• https://twitter.com/CVEnew/status/1990786254007324878 · Twitter Post