{"id":"CVE-2025-24521","state":"PUBLISHED","title":"Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference","description":"External XML entity injection allows arbitrary download of files. The \nscore without least privilege principle violation is as calculated \nbelow. In combination with other issues it may facilitate further \ncompromise of the device. Remediation in Version 6.8.0, release date: \n01-Mar-25.","publishedAt":"2025-03-05T15:17:23.659Z","updatedAt":"2025-03-06T21:57:07.875Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Keysight Ixia Vision Product Family"],"affected":[{"vendor":"Keysight","product":"Ixia Vision Product Family","defaultStatus":"unaffected","versions":[{"version":"6.3.1","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02","https://www.keysight.com/us/en/contact.html","https://support.ixiacom.com/","https://support.ixiacom.com/support-overview/product-support/downloads-updates"],"weaknesses":["CWE-611"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/24xxx/CVE-2025-24521.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-24521","state":"PUBLISHED","datePublished":"2025-03-05T15:17:23.659Z","dateUpdated":"2025-03-06T21:57:07.875Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-02-05T15:36:40.939Z"},"containers":{"cna":{"title":"Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference","descriptions":[{"lang":"en","value":"External XML entity injection allows arbitrary download of files. The \nscore without least privilege principle violation is as calculated \nbelow. In combination with other issues it may facilitate further \ncompromise of the device. Remediation in Version 6.8.0, release date: \n01-Mar-25."}],"affected":[{"vendor":"Keysight","product":"Ixia Vision Product Family","defaultStatus":"unaffected","versions":[{"version":"6.3.1","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02"},{"url":"https://www.keysight.com/us/en/contact.html"},{"url":"https://support.ixiacom.com/"},{"url":"https://support.ixiacom.com/support-overview/product-support/downloads-updates"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-03-05T15:17:23.659Z"},"credits":[{"lang":"en","type":"finder","value":"NATO Cyber Security Centre (NCSC) reported these vulnerabilities to Keysight."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Keysight recommends that all users <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.ixiacom.com/support-overview/product-support/downloads-updates\">upgrade to the latest version of software as soon as possible.</a> \n\nRemediation in Version 6.8.0, release date: \n01-Mar-25.\n\n\n\n Older versions of this software may have this vulnerability; Keysight \nrecommends that users discontinue the use of older software versions.\n<p>For more information about the Ixia Vision Product Family, please visit <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.ixiacom.com/\">Ixia product support</a></p>Further questions can be answered by <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.keysight.com/us/en/contact.html\">contacting Keysight.</a>\n\n<br>"}],"value":"Keysight recommends that all users  upgrade to the latest version of software as soon as possible. https://support.ixiacom.com/support-overview/product-support/downloads-updates  \n\nRemediation in Version 6.8.0, release date: \n01-Mar-25.\n\n\n\n Older versions of this software may have this vulnerability; Keysight \nrecommends that users discontinue the use of older software versions.\nFor more information about the Ixia Vision Product Family, please visit  Ixia product support https://support.ixiacom.com/ \n\nFurther questions can be answered by  contacting Keysight. https://www.keysight.com/us/en/contact.html"}],"source":{"advisory":"ICSA-25-063-02","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-06T21:56:42.423574Z","id":"CVE-2025-24521","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-06T21:57:07.875Z"}}]}}}