CVE-2021-37425: Altova MobileTogether Server XXE allows config and private key theft

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.1 with network reachability, no authentication, no user interaction, and public exploit references, plus high EPSS, make this an urgent exposure for any internet-facing instance.

What it is

Altova MobileTogether Server before 7.3 SP1 is vulnerable to XML external entity (XXE) injection. An unauthenticated remote attacker can submit crafted XML to endpoints such as /workflowmanagement, causing the server to resolve external entities. This matters because the flaw can expose the server configuration file and the certificate and private key it contains.

Impact

An attacker can read arbitrary files reachable by the server process, including mobiletogetherserver.cfg and the TLS certificate and private key, enabling credential and key compromise. The CVSS vector also indicates a high availability impact, so denial of service is possible.

Attack surface

Reachable over the network via HTTP requests to the workflow management endpoint; the CVSS vector shows no privileges and no user interaction required. Any exposed MobileTogether Server instance is directly attackable.

Exploitation

No CISA KEV listing and no ransomware association. EPSS is high (0.66, 99th percentile) and public references are tagged Exploit, indicating exploit code or a detailed advisory is publicly available.

What to do

• Upgrade MobileTogether Server to 7.3 SP1 or later, which is the fixed release named in the advisory.
• If immediate patching is not possible, disable external entity and DTD processing in the XML parser and restrict outbound network access from the server.
• Rotate the server certificate and private key and any credentials stored in mobiletogetherserver.cfg, since they may have been exposed.
• Restrict network access to the workflow management interface to trusted sources only.
• Review server logs for anomalous XML payloads or file-read attempts against configuration paths.

Detection

• Inspect HTTP request bodies to /workflowmanagement and other XML endpoints for DOCTYPE declarations, ENTITY definitions, or SYSTEM/PUBLIC identifiers.
• Alert on server process file reads of mobiletogetherserver.cfg, certificate files, or private key files outside normal startup behavior.
• Monitor for outbound connections from the server to unexpected hosts, which can indicate external entity resolution.
• Correlate WAF or proxy logs for XXE-style payload patterns against MobileTogether Server endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.