--- title: "SysAid On-Prem CVE-2025-2775/2776: Pre-Auth XXE in KEV" url: https://erroneo.us/security/briefs/sysaid-on-prem-cve-2025-2775-2776-xxe-kev/ description: "Unauthenticated XXE in SysAid On-Prem 23.3.40 and earlier leaks the admin password and chains to RCE. Fixed in 24.4.60 b16. Find old servers." type: security-brief section: "Security Digest" date_published: 2025-03-03 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2025-2775", "CVE-2025-2776"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # SysAid On-Prem CVE-2025-2775/2776: Pre-Auth XXE in KEV **Verdict: Check exposure.** SysAid On-Prem servers on 24.4.60 or later are fine; anything on 23.3.40 or older that is reachable from the internet should be upgraded now and treated as compromised, because the admin password can be read without logging in. - **Who must act:** Anyone running self-hosted SysAid On-Prem older than 24.4.60, especially servers whose web interface or agent endpoints face the internet. - **Who can relax:** SysAid Cloud (SaaS) customers, whose platform SysAid runs, and On-Prem servers already on 24.4.60 b16 or later with no sign of past tampering. - **Affected:** SysAid On-Prem 23.3.40 and earlier (CVE records and watchTowr); Treat any On-Prem build older than 24.4.60 b16 as vulnerable - **Fixed:** SysAid On-Prem 24.4.60 b16 (released early March 2025) - **CVEs:** CVE-2025-2775, CVE-2025-2776 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Find every SysAid On-Prem server and record its installed version. 2. Upgrade anything older than 24.4.60 b16 to the latest On-Prem release SysAid offers you. 3. Change the main administrator password, and check whether logs\InitAccount.cmd still holds it in plaintext. 4. Block internet access to /mdm/checkin, /mdm/serverurl and /lshw unless remote agents or mobile devices need them. 5. If a vulnerable server was internet-facing, review admin accounts and API settings and hunt for the post-auth command injection. ### How to check if you are affected - Search web or proxy logs for POST requests to /mdm/checkin, /mdm/serverurl or /lshw whose bodies contain a DOCTYPE declaration. - Look for outbound HTTP requests from the SysAid server to unfamiliar hosts, which is how these XXE payloads fetch external DTDs and leak data. - Review POST requests to /API.jsp that set updateApiSettings and javaLocation, and inspect updateApi.bat (updateApi.sh on Linux) for injected commands. - Check for admin logins from unexpected IP addresses and for administrator accounts nobody created. ## What happened SysAid On-Prem is SysAid's self-hosted IT service management and help desk product. In December 2024 and January 2025, watchTowr Labs reported three XML external entity (XXE) bugs that need no login. SysAid fixed them without assigning CVEs in On-Prem 24.4.60 b16, which watchTowr says shipped on March 3, 2025. On May 7, 2025, [watchTowr published the details](https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/) and a proof of concept. The [CVE-2025-2775](https://www.cve.org/CVERecord?id=CVE-2025-2775) record covers the "Checkin" handler (`/mdm/checkin`). The [CVE-2025-2776](https://www.cve.org/CVERecord?id=CVE-2025-2776) record covers the "Server URL" handler (`/mdm/serverurl`). A third bug in `/lshw` is CVE-2025-2777, which is not in KEV. SysAid's [release notes](https://web.archive.org/web/20260124173632/https://documentation.sysaid.com/docs/24-40-60) map the IDs to different endpoints; the fix is the same build. The XXE bugs can only read single-line files, and watchTowr found one worth reading. The installer writes the main administrator's password in clear text on the first line of `logs\InitAccount.cmd` and leaves the file in place. Once logged in as admin, an attacker can use CVE-2024-36394, a separate command injection in `API.jsp`, to run commands as SYSTEM. [The Hacker News](https://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html) reports that SysAid fixed that bug in 23.3.38 b19. CISA added both XXE CVEs to the [KEV catalog on July 22, 2025](https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog). CISA has not said what exploitation prompted the listing. Neither [SecurityWeek](https://www.securityweek.com/cisa-warns-of-sysaid-vulnerability-exploitation/) nor [The Hacker News](https://thehackernews.com/2025/07/cisa-warns-sysaid-flaws-under-active.html) found public reports of attacks. SysAid told SecurityWeek that the listing "does not necessarily indicate" current exploitation. Both KEV entries list ransomware use as unknown. ## Who is affected Self-hosted SysAid On-Prem 23.3.40 and earlier, per the CVE records and watchTowr. Treat any build older than 24.4.60 b16 as vulnerable. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-2776) scores CVE-2025-2776 at 9.8 and [CVE-2025-2775](https://nvd.nist.gov/vuln/detail/CVE-2025-2775) at 7.5. VulnCheck, the CNA, gives both 9.3. SecurityWeek cites Shadowserver counting 77 exposed vulnerable instances at disclosure. SysAid Cloud runs on SysAid's own infrastructure. ## Do you really need to act? Most SysAid customers do not. The fix is more than 18 months old. The risk is an On-Prem server that missed upgrades and still answers on the internet. The attack needs no credentials and leaks the admin password. With admin access, the published chain gives code execution as SYSTEM on a machine that holds internal tickets, knowledge base entries and asset inventories. SysAid has been targeted before: SecurityWeek notes that Cl0p affiliates exploited a SysAid zero-day (CVE-2023-47246) in 2023. Upgrade and investigate any old, exposed server. ## What to do now 1. List the installed version on each Windows host: `Get-ItemProperty HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*SysAid*' | Select-Object DisplayName, DisplayVersion`. 2. Upgrade anything older than 24.4.60 b16 to the newest On-Prem build SysAid provides. 3. Check `C:\Program Files\SysAidServer\logs\InitAccount.cmd`. If it still contains the original admin password, change that password at once. 4. Keep `/mdm/checkin`, `/mdm/serverurl` and `/lshw` off the internet unless remote agents or mobile devices need them. Put the portal behind a VPN or reverse proxy. 5. If a server was exposed while vulnerable, review administrators and API settings and rotate credentials stored in SysAid. ## How to tell if you were hit Search access logs for POST requests to the three XXE endpoints with `