{"id":"CVE-2025-24521","aliases":["EUVD-2025-6172","GHSA-m8gj-rhh9-783q"],"status":"published","title":"Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference","description":"External XML entity injection allows arbitrary download of files. The \nscore without least privilege principle violation is as calculated \nbelow. In combination with other issues it may facilitate further \ncompromise of the device. Remediation in Version 6.8.0, release date: \n01-Mar-25.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00428,"percentile":0.37563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2025-03-05T15:17:23Z","modified":"2026-06-17T08:59:09Z","products":[{"vendor":"keysight","product":"ixia vision product family"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02"},{"url":"https://www.keysight.com/us/en/contact.html"},{"url":"https://support.ixiacom.com/"},{"url":"https://support.ixiacom.com/support-overview/product-support/downloads-updates"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24521"},{"url":"https://support.ixiacom.com"},{"url":"https://github.com/advisories/GHSA-m8gj-rhh9-783q"}],"sources":{"cve":[{"id":"CVE-2025-24521","title":"Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference","description":"External XML entity injection allows arbitrary download of files. The \nscore without least privilege principle violation is as calculated \nbelow. In combination with other issues it may facilitate further \ncompromise of the device. Remediation in Version 6.8.0, release date: \n01-Mar-25.","status":"published","published":"2025-03-05T15:17:23.659Z","modified":"2025-03-06T21:57:07.875Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:32:43.770144Z"}],"euvd":[{"id":"EUVD-2025-6172","description":"External XML entity injection allows arbitrary download of files. The \nscore without least privilege principle violation is as calculated \nbelow. In combination with other issues it may facilitate further \ncompromise of the device. Remediation in Version 6.8.0, release date: \n01-Mar-25.","status":"published","published":"2025-03-05T15:17:23Z","modified":"2025-03-06T21:57:07Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:53:11.059252Z"}],"ghsa":[{"id":"GHSA-m8gj-rhh9-783q","title":"External XML entity injection allows arbitrary download of files. The \nscore without least...","description":"External XML entity injection allows arbitrary download of files. The \nscore without least privilege principle violation is as calculated \nbelow. In combination with other issues it may facilitate further \ncompromise of the device. Remediation in Version 6.8.0, release date: \n01-Mar-25.","status":"published","published":"2025-03-05T18:32:09Z","modified":"2025-03-05T18:32:16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:00:09.656651Z"}],"nvd":[{"id":"CVE-2025-24521","description":"External XML entity injection allows arbitrary download of files. The \nscore without least privilege principle violation is as calculated \nbelow. In combination with other issues it may facilitate further \ncompromise of the device. Remediation in Version 6.8.0, release date: \n01-Mar-25.","status":"published","published":"2025-03-05T16:15:39.093Z","modified":"2026-06-17T08:59:09.807Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:10:53.101324Z"}]}}