CVE-2025-2777 is a critical (CVSS 9.3) unauthenticated XML External Entity flaw in SysAid On-Prem version 23.3.40 and earlier. The lshw processing function accepts crafted XML, which the record says allows administrator account takeover and file reads. Upgrade to a current SysAid release and review exposure.
What's affected
The record says SysAid On-Prem versions up to and including 23.3.40 are affected. The vendor lists its fixes in release documentation, and the record links the 24.40.60 release notes page. When we fetched that page it returned a not found response, so confirm the exact fixed version in SysAid's current documentation rather than assuming one.
The watchTowr Labs write-up, linked in the record, describes the research behind the report and puts this issue among several flaws in the product. We do not repeat technical detail beyond what the advisory and record say.
Severity in the record: critical, CVSS 9.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. Weakness classes: CWE-611 (XML external entity reference).
How to check if you're exposed
SysAid On-Prem is a server product, so check the installed version and its exposure.
- Sign in to the SysAid administration console and read the version in the About or system information screen.
- Compare it with 23.3.40. Any version at or below it is within the range in the record.
- Check whether the SysAid web interface is reachable from the internet, for example through your reverse proxy or firewall rules.
- Review access logs for requests to the lshw agent endpoint from addresses that are not your own managed hosts.
What to do now
- Upgrade SysAid On-Prem to the release named as fixed in SysAid's current release notes.
- Until you can patch, remove internet exposure of the SysAid server or limit it to known agent and user networks.
- Review administrator accounts in SysAid and look for ones you did not create. Rotate administrator passwords and any API keys or integration credentials stored in the system.
- Check the server for unexpected files and processes, and review logs back to the date of your first exposure.
- Because a help desk holds credentials in tickets and attachments, consider which secrets might have been readable and rotate them.
- Take a backup before upgrading and test it.
Why it matters
XML External Entity injection (CWE-611) happens when an XML parser is allowed to resolve references that point outside the document, such as to local files or remote addresses. A server that parses XML from an unauthenticated request can then be made to read files or make requests on the attacker's behalf. The record says this one allows file read and administrator account takeover.
The score is 9.3 because it needs no login and no user interaction, and the scope is changed. Help desk systems are attractive targets because they sit inside the network, hold many users and often store credentials in tickets. A fix for the whole class is to disable external entity and document type processing in the XML parser, which is also a good check for any XML you parse in your own code.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
What is the last affected version of SysAid On-Prem?
23.3.40 according to the record. Versions after that are the ones to look for in SysAid's release notes.
Does the record say CVE-2025-2777 is exploited in the wild?
No. It is not flagged as known exploited in the record we used. Check the vendor advisory for any change.
Sources
- SysAid release documentation (page returned not found when fetched)
- watchTowr Labs write-up
- Safeguard Gold entry for CVE-2025-2777
Last reviewed: 19 October 2026.
