Remote Code Execution Vulnerability in WSO2 Products
CVE-2025-5717

6.8MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Open Banking Am
Wso2 Traffic Manager
Wso2 Api Control Plane
Vendor
CVE Published:
23 September 2025

What is CVE-2025-5717?

An authenticated remote code execution vulnerability exists in multiple WSO2 products due to improper input validation within the event processor admin service. This issue can be exploited by users with administrative access to the SOAP admin services by deploying a malicious Siddhi execution plan containing harmful Java code. Successful exploitation allows for arbitrary code execution on the server, making it crucial for organizations using affected WSO2 products to implement necessary security measures and monitor user access rights.

Affected Version(s)

Siddhi Extension Evaluate Scripts 3.2.6 < 3.2.6.8

Siddhi Extension Evaluate Scripts 3.2.7 < 3.2.7.6

Siddhi Extension Evaluate Scripts 3.2.8 < 3.2.8.3

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noël MACCARY
JSON
.