CVE-2025-2777criticalobserved exploitationCWE-611

CVE-2025-2777: critical vulnerability in SysAid On-Prem

SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection

Published · Updated

Follow this CVE+ Monitor SysAid On-Prem

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.3epss 73%
from disclosure to weaponsame day
Published on NVDMay 7
1st PoCMar 28
VulnCheck+7d
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Affected products
SysAid · SysAid On-Prem
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SysAid On-Prem

In the same product, most dangerous first.

CVE-2025-2776CRITICALSysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity InjectionEPSS 65.2%KEVCVE-2025-2775CRITICALSysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity InjectionEPSS 43.2%KEV