CVE-2025-2775 is an unauthenticated XXE vulnerability in SysAid On-Prem's Checkin/MDM handler: a crafted XML POST to the endpoint is parsed without restricting external entities, so an attacker can read arbitrary single-line files from the server, and researchers showed this can be used to read InitAccount.cmd — a setup script that contains the main administrator's plaintext password on its first line — handing an unauthenticated attacker full admin access to the helpdesk.
Vulnerability summary
7.5
High
42.6%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-05-07
Published
Vulnerability ID: CVE-2025-2775 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| SysAid On-Premises | cpe:2.3:a:sysaid:sysaid:*:*:*:*:on-premises:*:*:* | through 23.3.40 |
What this means
CVE-2025-2775 is an improper restriction of XML external entity reference vulnerability (CWE-611). NVD's description states: "SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives" (NVD).
NVD has published its own independent Primary CVSS metric: CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. A separate Secondary score from VulnCheck rates the same issue higher, CVSS v3.1 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), reflecting a scope-changed assessment of the account-takeover impact; this page reports the NVD Primary figure as the confirmed score (NVD).
Security researchers at watchtowr Labs, who disclosed the issue, traced the flaw to the GetMdmMessage#doPost method, which parses attacker-supplied POST data via PropertyListParser.parse(byteArray) without validating or sanitizing the XML, enabling classic XXE file reads. While Java's XML parser mitigations block multi-line file exfiltration via this primitive, watchtowr found that C:\Program Files\SysAidServer\logs\InitAccount.cmd is a single-line file containing the SysAid main administrator account's password in plaintext on its first line — letting the XXE alone yield full administrative credentials. The researchers further chained this with a separate, previously disclosed post-authentication command injection (CVE-2024-36394) to achieve remote command execution as SYSTEM (watchtowr Labs).
CISA added CVE-2025-2775 to the Known Exploited Vulnerabilities catalog on 2025-07-22, with a required-action due date of 2025-08-12 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.4261 (98.708th percentile), consistent with active, documented use against a widely deployed IT service management product (FIRST EPSS).
Because the practical impact is full administrator takeover rather than a narrow information leak, SysAid On-Prem operators should upgrade past 23.3.40 to a release that addresses this XXE, rotate the main administrator password and any credentials that could have been exposed via InitAccount.cmd, and audit logs for unexpected requests to the Checkin/MDM endpoint.
Evidence
- Unauthenticated XXE in SysAid On-Prem's Checkin processing functionality, affecting versions through 23.3.40, enabling administrator account takeover and file read primitives. — NVD
- NVD Primary CVSS v3.1 base score is 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; a VulnCheck Secondary score separately rates it 9.3 under a scope-changed vector. — NVD
- Root cause is unsafe XML parsing in GetMdmMessage#doPost; the XXE can read the single-line InitAccount.cmd file, which discloses the main admin's plaintext password, enabling full admin takeover, and can be chained with CVE-2024-36394 for RCE as SYSTEM. — watchtowr Labs
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-07-22, required-action due date 2025-08-12. — CISA KEV
- EPSS score is 0.4261 (98.708th percentile) as of 2026-10-29. — FIRST EPSS
