SysAid On-Prem - XXE (CVE-2025-2777)

CVE-2025-2777 is a critical vulnerability in SysAid On-Prem that allows unauthenticated attackers to exploit an XML External Entity (XXE) parsing flaw within specific system information handling, potentially leading to administrator account compromise and arbitrary file reads.

CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-2777 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-2777. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers are observed focusing on URLs that begin with /lshw and contain several system-related parameters, indicating tailored probes against environments running the affected software.