XML External Entity Vulnerability in beecue FastBee SIP Message Handler
CVE-2025-15251

6.3MEDIUM

Key Information:

Vendor

Beecue

Status
Fastbee
Vendor
CVE Published:
30 December 2025

What is CVE-2025-15251?

A vulnerability exists in beecue FastBee's SIP Message Handler where the function getRootElement is susceptible to XML External Entity (XXE) attacks. This flaw allows remote attackers to manipulate XML data, potentially leading to sensitive information disclosure. Exploiting this vulnerability requires advanced technical skills due to the high complexity involved. The project maintainers have acknowledged the issue and are working towards a resolution.

Affected Version(s)

FastBee 2.0

FastBee 2.1

References

https://vuldb.com/?id.338641
vdb-entrytechnical-description
https://vuldb.com/?ctiid.338641
signaturepermissions-required
https://gitee.com/beecue/fastbee/issues/ID7HNZ
issue-tracking

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VulDB Gitee Analyzer
.