Security readout for executives and security teams
Plain-English summary
SysAid On-Prem deployments at or below 23.3.40 have a critical unauthenticated XML parsing flaw. A remote attacker could abuse Checkin processing to read files and potentially take over an administrator account, creating urgent business risk for exposed helpdesk systems.
Executive priority
Treat this as urgent. The vulnerability is critical, remotely reachable, unauthenticated, and listed by CISA as known exploited. Any exposed SysAid On-Prem instance should be remediated or isolated immediately.
Technical view
CVE-2025-2775 is a CWE-611 XML External Entity vulnerability in SysAid On-Prem Checkin processing. The CVSS 3.1 score is 9.3, with network access, low complexity, no privileges, and no user interaction required. Reported impact includes administrator account takeover and file-read primitives.
Likely exposure
Internet-facing or partner-accessible SysAid On-Prem instances are the highest concern, especially versions at or below 23.3.40. Cloud-hosted SysAid exposure is not established by the provided sources.
Exploitation context
CISA lists CVE-2025-2775 in the Known Exploited Vulnerabilities catalog, so active exploitation is supported. watchTowr also published public exploit research, increasing attacker awareness. The provided bundle does not include detailed campaign scope or victim counts.
Researcher notes
Focus validation on SysAid On-Prem Checkin processing and XXE exposure. Do not assume affected cloud products or fixed versions beyond vendor guidance. Evidence supports known exploitation, but the bundle does not provide safe detection indicators or complete remediation details.
Mitigation direction
- Inventory all SysAid On-Prem deployments and confirm exact running versions.
- Prioritize systems at or below 23.3.40 for immediate remediation.
- Review SysAid vendor guidance and apply the recommended update or workaround.
- Restrict external access to SysAid On-Prem until remediation is complete.
- Monitor SysAid logs for suspicious unauthenticated Checkin processing activity.
Validation and detection
- Confirm whether any SysAid On-Prem instance is version 23.3.40 or earlier.
- Check internet exposure through asset inventory and external attack-surface records.
- Verify remediation against SysAid's vendor advisory, not only package inventory.
- Review authentication, administrator, and file-access logs for anomalies.
- Track CISA KEV deadlines and internal remediation ownership.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-611: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-2775 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L3.94.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://documentation.sysaid.com/docs/24-40-60CVE reference · vendor-advisory
- https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/CVE reference · exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2775CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.