CVE-2025-2777: SysAid On-Prem unauthenticated XXE in lshw processing

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable XXE with CVSS 9.8 leading to admin takeover and file read, plus very high EPSS and public exploit references.

What it is

SysAid On-Prem versions up to 23.3.40 process lshw data through an XML parser that resolves external entities, so an unauthenticated request can trigger XXE. The flaw is critical because it leads to administrator account takeover and arbitrary file read on the server.

Impact

An attacker can read files from the SysAid server and take over an administrator account, giving full control of the application and its data.

Attack surface

Reachable over the network through the lshw processing endpoint with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is 0.72202 (99.4th percentile) and public exploit write-ups are referenced, indicating active interest and likely weaponization.

What to do

• Upgrade SysAid On-Prem to a fixed release (24.40.60 or later per vendor release notes) immediately.
• If patching cannot be done at once, restrict network access to the SysAid server and its lshw processing endpoint to trusted management networks only.
• Disable or block external entity resolution in the XML parser if the product exposes such a configuration.
• Rotate administrator credentials and review admin accounts for unauthorized changes after exposure.
• Monitor vendor advisories for further guidance and any additional fixed versions.

Detection

• Search web and application logs for requests to lshw-related endpoints containing DOCTYPE or ENTITY declarations.
• Alert on outbound HTTP/DNS connections from the SysAid server to unexpected external hosts, which may indicate XXE data exfiltration.
• Audit administrator account creation, password changes, and login events for anomalies around the time of suspicious lshw requests.
• Monitor file access patterns on the SysAid host for reads of sensitive files such as configuration or credential stores.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.