XML Injection Vulnerability in Ixia's Network Testing Tools
CVE-2025-24521

6.9MEDIUM

Key Information:

Vendor

Keysight

Status
Ixia Vision Product Family
Vendor
CVE Published:
5 March 2025

What is CVE-2025-24521?

An external XML entity injection vulnerability exists in Ixia's network testing tools, allowing an attacker to arbitrarily download files from the system. This flaw can lead to unauthorized access and compromise, particularly when combined with other weaknesses in the environment. It's crucial for users to update their software to Version 6.8.0, released on March 1, 2025, to mitigate this risk.

Affected Version(s)

Ixia Vision Product Family 6.3.1

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-0...
https://www.keysight.com/us/en/contact.html
https://support.ixiacom.com/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NATO Cyber Security Centre (NCSC) reported these vulnerabilities to Keysight.
.