# CVE-2025-2777: SysAid On-Prem - XXE

> Live exploitation tracking for CVE-2025-2777 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-2777

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** SysAid On-Prem
- **Weaknesses:** CWE-611 (Improper Restriction of XML External Entity Reference)
- **Tags:** enterprise_software

## Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality,  allowing for administrator account takeover and file read primitives.

## CrowdSec analysis

[CVE-2025-2777](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-2777) is a critical vulnerability in SysAid On-Prem that allows unauthenticated attackers to exploit an XML External Entity (XXE) parsing flaw within specific system information handling, potentially leading to administrator account compromise and arbitrary file reads.

CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-2777 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers are observed focusing on URLs that begin with `/lshw` and contain several system-related parameters, indicating tailored probes against environments running the affected software.

## Timeline

- 2025-05-07: CVE Published. CVE-2025-2777 is published to NVD.
- 2025-05-28: Rule Released. CrowdSec releases a rule to detect CVE-2025-2777 exploitation attempts against the CrowdSec Network.
- 2025-05-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-2777 for the first time.

## References

- https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/
- https://documentation.sysaid.com/docs/24-40-60
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2777.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-2777) follows observed exploitation activity for CVE-2025-2777. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.