PT-2025-43555 · Bae Systems · Bae Socet Gxp

Published 2025-10-23 · Updated 2025-10-24 · CVE-2025-54964

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BAE SOCET GXP versions prior to 4.6.0.2

Description An attacker who can interact with the GXP Job Service may be able to inject arbitrary executables. If the Job Service is configured for local access, this could lead to privilege escalation. If the Job Service is accessible over a network, this could lead to remote command execution. The GXP Job Service is the component at risk.

Recommendations Update BAE SOCET GXP to version 4.6.0.2 or later.

Fix

LPE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-54964

Affected Products

Bae Socet Gxp

References · 7

• https://osv.dev/vulnerability/CVE-2025-54964 · Vendor Advisory
• https://geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54964 · Security Note
• https://t.me/CVEtracker/35606 · Telegram Post
• https://baesystems.com/en-us/product/geospatial-exploitation-products · Note
• https://twitter.com/VulmonFeeds/status/1981553516251336837 · Twitter Post
• https://twitter.com/CVEnew/status/1981454850966642974 · Twitter Post