Improper XML External Entity (XXE) in SysAid On-Prem (CVE-2025-2775) Enables Admin Takeover
What It Is — SysAid On‑Prem contains an improper restriction of XML external entity (XXE) reference vulnerability in its check‑in processing functionality. Crafted XML payloads can trigger external entity resolution, leading to administrator account takeover and arbitrary file reads.
Exploitability — Publicly disclosed; proof‑of‑concept code is available. No confirmed active exploit campaigns, but the flaw is trivial to weaponize. CVSS v3.1 score: 9.3 (High).
Affected Products — SysAid On‑Prem (all supported versions prior to the vendor’s patch release).
Why It Matters for Trust & Control Assurance
- Validates the control objective of secure input validation and configuration management, a requirement that maps to many frameworks (e.g., NIST CSF, ISO 27001).
- Shows the necessity of continuous monitoring of third‑party software for unpatched critical flaws, providing defensible evidence of due‑diligence.
- Highlights how a single unaddressed vulnerability can undermine audit‑ready privileged‑access controls, a key trust signal for enterprise buyers.
Recommended Actions
- Apply the vendor‑issued patch or follow the mitigation guidance (disable external entity processing).
- Verify that XML parsers are hardened against XXE and document the change.
- Capture remediation evidence in your control‑mapping repository to support audit readiness. Source: CISA KEV – CVE‑2025‑2775