CVE-2025-2775
SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
Description
CVE-2025-2775 is a critical XML External Entity (XXE) injection vulnerability in SysAid On-Prem versions 23.3.40 and earlier, specifically in the Checkin processing functionality. This unauthenticated vulnerability allows a remote attacker to exploit improper handling of XML input to achieve administrator account takeover and read arbitrary files from the server. With a CVSS v3.1 base score of 9.3 (Critical), the vulnerability requires no authentication or user interaction, and the changed scope means it can affect resources beyond the vulnerable SysAid application itself. CISA has added CVE-2025-2775 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 12, 2025, and its EPSS score of 65.19% at the 98th percentile places it among the most likely vulnerabilities to be exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sysaid | sysaid | <= 23.3.40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://documentation.sysaid.com/docs/24-40-60(Release Notes)
- https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2775(US Government Resource)
Weakness Type
CWE-611: Improper Restriction of XML External Entity Reference
CVE-2025-2775 is classified under CWE-611, which occurs when an application processes XML input that contains references to external entities without properly restricting or disabling this functionality. In SysAid On-Prem, the Checkin processing endpoint parses XML data from incoming requests without disabling external entity resolution. This allows an attacker to craft malicious XML payloads that instruct the parser to retrieve sensitive files from the server, perform server-side request forgery, or extract credentials that enable administrator account takeover.
Learn more: CWE-611 — Improper Restriction of XML External Entity Reference
Impact Analysis
The impact of CVE-2025-2775 is severe, as reflected in its CVSS v3.1 score of 9.3 (Critical). The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). The changed scope (S:C) indicates that exploitation can compromise resources beyond the SysAid application, such as the underlying operating system and connected infrastructure. Confidentiality faces the highest impact (C:H) as the XXE allows reading arbitrary files from the server including configuration files, database credentials, and user data, ultimately enabling administrator account takeover. Availability is partially affected (A:L) as certain exploitation techniques may cause service degradation. With an EPSS score of 65.19%, CVE-2025-2775 ranks in the 98th percentile, meaning it is more likely to be exploited than 98% of all known vulnerabilities, making immediate remediation essential.
Exploit Maturity
CVE-2025-2775 demonstrates very high exploit maturity with confirmed active exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, and public exploit code and a detailed technical writeup are available via watchTowr Labs, which provides a comprehensive analysis of the exploitation chain. The EPSS score of 65.19% at the 98th percentile reflects near-certain exploitation activity. SysAid has been a high-profile target for threat actors in the past, and the combination of unauthenticated access, administrator account takeover capability, and publicly available exploit code makes this vulnerability particularly dangerous. Organizations should assume active targeting and prioritize immediate patching.
Remediation
-
Upgrade SysAid On-Prem immediately. Update to version 24.4.60 or later, which addresses CVE-2025-2775 and related vulnerabilities. Refer to the SysAid release notes for upgrade procedures and compatibility information.
-
Disable XML external entity processing. If immediate patching is not possible, configure the XML parser used by SysAid to disable external entity resolution, DTD processing, and XInclude features. This serves as a critical interim mitigation.
-
Restrict network access to SysAid. Implement firewall rules to limit access to the SysAid web interface and Checkin endpoint to trusted networks only. Block public internet access to the application until patching is complete.
-
Investigate for compromise. Review web server logs for unusual requests to the Checkin endpoint, particularly those containing XML payloads with entity declarations. Check for unauthorized administrator accounts, modified configurations, or evidence of data exfiltration. Rotate all administrator credentials and API keys.
-
Implement WAF rules. Deploy web application firewall rules that detect and block XXE payloads in incoming requests, including patterns such as
<!ENTITY,<!DOCTYPE, and external entity references targeting system files.
Technical Details
CVE-2025-2775 is an unauthenticated XML External Entity injection vulnerability in the SysAid On-Prem Checkin processing functionality, with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. The vulnerability exists because the application's XML parser processes external entity declarations embedded within XML input submitted to the Checkin endpoint. When an attacker sends a specially crafted XML payload containing an external entity reference, the parser resolves it by reading the referenced resource — which can be a local file on the server, an internal network service, or an external URL. This enables file disclosure attacks where sensitive files such as /etc/passwd, application configuration files, or database connection strings are exfiltrated through the XML response or out-of-band channels. The watchTowr Labs research demonstrates how this XXE can be chained to achieve administrator account takeover by extracting authentication tokens or credentials from the SysAid server's file system, ultimately enabling full control over the IT service management platform.
Frequently Asked Questions
Is CVE-2025-2775 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-2775 by adding it to the Known Exploited Vulnerabilities catalog. Public exploit code and a detailed writeup are available from watchTowr Labs. The EPSS score of 65.19% at the 98th percentile indicates a very high probability of exploitation.
What products are affected by CVE-2025-2775?
SysAid On-Prem versions 23.3.40 and earlier are affected. The vulnerability specifically impacts the Checkin processing functionality. Organizations should upgrade to version 24.4.60 or later to remediate.
How do I fix CVE-2025-2775?
Upgrade SysAid On-Prem to version 24.4.60 or later immediately. As interim mitigations, disable XML external entity processing in the application's XML parser, restrict network access to the SysAid interface, and monitor for indicators of compromise.
How severe is CVE-2025-2775?
CVE-2025-2775 carries a CVSS v3.1 base score of 9.3 (Critical). It enables unauthenticated remote exploitation with no user interaction, allowing administrator account takeover and arbitrary file reading. Its 98th percentile EPSS ranking makes it one of the most likely vulnerabilities to face active exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.