Critical Pre-Auth RCE vulnerabilities discovered in SysAid On-Premise IT support software
Take action: If you're using SysAid On-Premise (version 23.3.40 or earlier), update immediately to version 24.4.60 b16 or newer. These vulnerabilities have already been weaponized with a public proof-of-concept exploit, and SysAid has previously been targeted by ransomware groups. It's only a matter of time before youe SysAid is attacked.
Learn More
Cybersecurity researchers from watchTowr Labs are reporting multiple critical security vulnerabilities in SysAid's on-premise IT support software. When chained together, these flaws allow attackers to achieve pre-authenticated remote code execution with SYSTEM privileges.
The researchers identified three XML External Entity (XXE) injection vulnerabilities that can be exploited without authentication:
- CVE-2025-2775 (CVSS score 9.3) - Pre-Authentication XXE vulnerability in the
/mdm/checkinendpoint - CVE-2025-2776 (CVSS score 9.3) - Pre-Authentication XXE vulnerability in the
/mdm/serverurlendpoint - CVE-2025-2777 (CVSS score 9.3) - Pre-Authentication XXE vulnerability in the
/lshwendpoint
When combined with a post-authentication OS command injection vulnerability CVE-2025-2778 (CVSS score 9.8) discovered by an unknown third party, these flaws create a complete attack chain for remote code execution.
The researchers detailed a sophisticated attack chain involving these vulnerabilities:
- Attackers first exploit one of the XXE vulnerabilities to extract sensitive information from the target system, targeting the
InitAccount.cmdfile. - This file contains the plaintext administrator credentials created during installation, which remain accessible even after setup is complete.
- Using these administrator credentials, attackers can authenticate to the application and exploit the OS command injection vulnerability (CVE-2025-2778).
- The command injection vulnerability exists in how the application handles the
javaLocationparameter, allowing attackers to inject arbitrary commands into batch files that are subsequently executed with SYSTEM privileges.
These flaws affect all versions of SysAid On-Premise up to and including version 23.3.40.
Previous vulnerabilities in SysAid ( CVE-2023-47246) have been exploited by ransomware operators like Cl0p as zero-day attacks. Since ITSM solutions like SysAid serve as business-critical infrastructure containing sensitive organizational data, they remain attractive targets for attackers seeking to exfiltrate data or deploy ransomware.
SysAid has fixed all four vulnerabilities in version 24.4.60 b16, released in early March 2025. Organizations using SysAid On-Premise are strongly urged to update to this or newer versions.
