erroneo.us
Search all guides⌘K

Security Digest · Mar 3, 2025 · Vulnerability · Other

SysAid On-Prem CVE-2025-2775/2776: Pre-Auth XXE in KEV

Unauthenticated XXE in SysAid On-Prem 23.3.40 and earlier leaks the admin password and chains to RCE. Fixed in 24.4.60 b16. Find old servers.

Published By erroneo.us Security Desk · Updated 3 min read12 sources

Our verdict

Check exposure

SysAid On-Prem servers on 24.4.60 or later are fine; anything on 23.3.40 or older that is reachable from the internet should be upgraded now and treated as compromised, because the admin password can be read without logging in.

Who must act: Anyone running self-hosted SysAid On-Prem older than 24.4.60, especially servers whose web interface or agent endpoints face the internet.

Who can relax: SysAid Cloud (SaaS) customers, whose platform SysAid runs, and On-Prem servers already on 24.4.60 b16 or later with no sign of past tampering.

Affected
SysAid On-Prem 23.3.40 and earlier (CVE records and watchTowr)
Treat any On-Prem build older than 24.4.60 b16 as vulnerable
Fixed in
SysAid On-Prem 24.4.60 b16 (released early March 2025)
CVSS
9.8 (v3.1, NVD)
EPSS
64.7% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Find every SysAid On-Prem server and record its installed version.
  2. Upgrade anything older than 24.4.60 b16 to the latest On-Prem release SysAid offers you.
  3. Change the main administrator password, and check whether logs\InitAccount.cmd still holds it in plaintext.
  4. Block internet access to /mdm/checkin, /mdm/serverurl and /lshw unless remote agents or mobile devices need them.
  5. If a vulnerable server was internet-facing, review admin accounts and API settings and hunt for the post-auth command injection.

How to check if you are affected or compromised

  • Search web or proxy logs for POST requests to /mdm/checkin, /mdm/serverurl or /lshw whose bodies contain a DOCTYPE declaration.
  • Look for outbound HTTP requests from the SysAid server to unfamiliar hosts, which is how these XXE payloads fetch external DTDs and leak data.
  • Review POST requests to /API.jsp that set updateApiSettings and javaLocation, and inspect updateApi.bat (updateApi.sh on Linux) for injected commands.
  • Check for admin logins from unexpected IP addresses and for administrator accounts nobody created.

What happened#

SysAid On-Prem is SysAid's self-hosted IT service management and help desk product. In December 2024 and January 2025, watchTowr Labs reported three XML external entity (XXE) bugs that need no login. SysAid fixed them without assigning CVEs in On-Prem 24.4.60 b16, which watchTowr says shipped on March 3, 2025. On May 7, 2025, watchTowr published the details and a proof of concept. The CVE-2025-2775 record covers the "Checkin" handler (/mdm/checkin). The CVE-2025-2776 record covers the "Server URL" handler (/mdm/serverurl). A third bug in /lshw is CVE-2025-2777, which is not in KEV. SysAid's release notes map the IDs to different endpoints; the fix is the same build.

The XXE bugs can only read single-line files, and watchTowr found one worth reading. The installer writes the main administrator's password in clear text on the first line of logs\InitAccount.cmd and leaves the file in place. Once logged in as admin, an attacker can use CVE-2024-36394, a separate command injection in API.jsp, to run commands as SYSTEM. The Hacker News reports that SysAid fixed that bug in 23.3.38 b19.

CISA added both XXE CVEs to the KEV catalog on July 22, 2025. CISA has not said what exploitation prompted the listing. Neither SecurityWeek nor The Hacker News found public reports of attacks. SysAid told SecurityWeek that the listing "does not necessarily indicate" current exploitation. Both KEV entries list ransomware use as unknown.

Who is affected#

Self-hosted SysAid On-Prem 23.3.40 and earlier, per the CVE records and watchTowr. Treat any build older than 24.4.60 b16 as vulnerable. NVD scores CVE-2025-2776 at 9.8 and CVE-2025-2775 at 7.5. VulnCheck, the CNA, gives both 9.3. SecurityWeek cites Shadowserver counting 77 exposed vulnerable instances at disclosure. SysAid Cloud runs on SysAid's own infrastructure.

Do you really need to act?#

Most SysAid customers do not. The fix is more than 18 months old. The risk is an On-Prem server that missed upgrades and still answers on the internet. The attack needs no credentials and leaks the admin password. With admin access, the published chain gives code execution as SYSTEM on a machine that holds internal tickets, knowledge base entries and asset inventories. SysAid has been targeted before: SecurityWeek notes that Cl0p affiliates exploited a SysAid zero-day (CVE-2023-47246) in 2023. Upgrade and investigate any old, exposed server.

What to do now#

  1. List the installed version on each Windows host: Get-ItemProperty HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*SysAid*' | Select-Object DisplayName, DisplayVersion.
  2. Upgrade anything older than 24.4.60 b16 to the newest On-Prem build SysAid provides.
  3. Check C:\Program Files\SysAidServer\logs\InitAccount.cmd. If it still contains the original admin password, change that password at once.
  4. Keep /mdm/checkin, /mdm/serverurl and /lshw off the internet unless remote agents or mobile devices need them. Put the portal behind a VPN or reverse proxy.
  5. If a server was exposed while vulnerable, review administrators and API settings and rotate credentials stored in SysAid.

How to tell if you were hit#

Search access logs for POST requests to the three XXE endpoints with <!DOCTYPE in the body. Check for outbound HTTP from the server to unknown hosts, since the payload fetches an attacker's DTD and sends file contents back in a URL. For the second stage, look for POST requests to /API.jsp that set updateApiSettings and javaLocation. Also inspect the generated updateApi.bat (or updateApi.sh) for commands that do not belong there. Admin logins from unfamiliar addresses suggest the password was taken.

Timeline#

  • — watchTowr reports the first XXE to SysAid. It reports two more on January 6, 2025.
  • — SysAid releases On-Prem 24.4.60, according to watchTowr. No CVEs are assigned.
  • — watchTowr publishes its research and proof of concept. The CVE records are published the same day.
  • — CISA adds CVE-2025-2775 and CVE-2025-2776 to KEV.
  • — CISA's remediation deadline for federal agencies.

Vulnerability records

  • CVE-2025-2775 · KEV 2025-07-22 · SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality…
  • CVE-2025-2776 · KEV 2025-07-22 · SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. SysAid — On-Prem 24.4.60 b16 release notes (archived copy) web.archive.org
  2. CVE record — CVE-2025-2775 cve.org
  3. CVE record — CVE-2025-2776 cve.org
  4. NVD — CVE-2025-2775 nvd.nist.gov
  5. NVD — CVE-2025-2776 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2025-2775 cisa.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2025-2776 cisa.gov
  8. CISA — CISA adds four known exploited vulnerabilities to catalog (Jul 22, 2025) cisa.gov
  9. watchTowr Labs — SysOwned, Your Friendly Support Ticket (SysAid On-Prem pre-auth RCE chain) labs.watchtowr.com

Coverage and analysis

  1. SecurityWeek — CISA warns of SysAid vulnerability exploitation securityweek.com
  2. The Hacker News — CISA warns SysAid flaws under active attack thehackernews.com
  3. The Hacker News — SysAid patches 4 critical flaws thehackernews.com