PT-2025-43993 · Bae Systems · Socet Gxp

Published 2025-10-27 · Updated 2025-11-03 · CVE-2025-54965

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BAE SOCET GXP versions prior to 4.6.0.2

Description An XSS issue exists in the SOCET GXP Job Status Service. The service does not properly sanitize the job ID parameter before using it in the job status page. An attacker may be able to execute arbitrary JavaScript in a victim's browser by social engineering a user into clicking a malicious link. The API endpoint involved is the job status page. The vulnerable parameter is job ID.

Recommendations Update BAE SOCET GXP to version 4.6.0.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54965

Affected Products

Socet Gxp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-54965 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54965 · Vendor Advisory
• https://geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54965 · Vendor Advisory
• https://baesystems.com/en-us/product/geospatial-exploitation-products · Note
• https://twitter.com/CVEnew/status/1982867550217101326 · Twitter Post
• https://t.me/cveNotify/141382 · Telegram Post