CVE-2025-24521
Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 5, 2025
- Updated
- Mar 6, 2025
- Reserved
- Feb 5, 2025
Description
External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | icscert |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
Ixia Vision Product FamilyKeysight |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.