CVE Alert: CVE-2025-2775 – SysAid – SysAid On-Prem

Risk verdict

Critical: unauthenticated XXE in the on‑prem Checkin service enables administrator account takeover; exploitation is active, treat as priority 1.

Why this matters

An attacker can achieve admin privileges and read sensitive files without user interaction, enabling data exposure and potential persistence. The on‑prem, network-accessible nature of the Checkin endpoint makes exposed or poorly segmented deployments especially attractive targets.

Most likely attack path

No user interaction required; the attacker sends crafted XML over the network to the Checkin service to trigger external entity processing and read local files, escalating to admin. The scope change indicates potential impact across connected components, increasing the likelihood of broader compromise.

Who is most exposed

Common in organisations with on‑prem management interfaces (IT, healthcare, MSPs) and those exposing management portals or VPN access to the Checkin service; failures in network segmentation or access controls heighten risk.

Detection ideas

• Look for XML payloads containing DOCTYPE/ENTITY declarations in Checkin requests.
• Unusual or unauthorized attempts to access admin-privileged endpoints from external or new internal IPs.
• Logs showing unexpected file read operations or abnormal privilege changes.
• Spikes in network traffic to the Checkin service from previously unseen sources.
• Anomalous authentication events indicating privilege escalations.

Mitigation and prioritisation

• Apply vendor patch or upgrade to a version that fixes XXE (treat as priority 1).
• If patching isn’t immediate, block external access to the Checkin endpoint and enforce network segmentation; implement WAF rules to block XXE patterns.
• Harden XML processing: disable external entities, enforce strict schema validation, and restrict file-system access during parsing.
• Impose input validation, strict logging, and alert on admin-privilege changes; include change-management for the upgrade.
• Verify backups and rehearse a rapid recovery plan in case of compromise.