SysAid Patches 4 Critical Flaws Enabling Pre-Auth RCE in On-Premise Version
May 07, 2025
Vulnerability / IT Service
Cybersecurity researchers have disclosed multiple security flaw in the on-premise version of SysAid IT support software that could be exploited to achieve pre-authenticated remote code execution with elevated privileges. The vulnerabilities, tracked as CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777, have all been described as XML External Entity ( XXE ) injections, which occur when an attacker is able to successfully interfere with an application's parsing of XML input. This, in turn, could permit attackers to inject unsafe XML entities into the web application, allowing them to carry out a Server-Side Request Forgery ( SSRF ) attack and in worst cases, remote code execution. A description of the three vulnerabilities, according to watchTowr Labs researchers Sina Kheirkhah and Jake Knott, is as follows - CVE-2025-2775 and CVE-2025-2776 - A pre-authenticated XXE within the /mdm/checkin endpoint CVE-2025-2777 - A pre-authenticated XXE within the /lshw endpoint watchTowr L...