CVE-2025-0617
MEDIUMTrellix HX Console < 5.1.1 - Denial of Service via XML Entity Expansion
Title source: llmDescription
An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger file parsing containing exponential entity expansions in the consumer process thus causing a Denial of Service.
References (1)
Core 1
Core References
Various Sources
https://thrive.trellix.com/s/article/000014214
Scores
CVSS v3
5.9
EPSS
0.0037
EPSS Percentile
28.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-776
Status
published
Products (1)
Trellix/Trellix HX Console
5.1.1
Published
Jan 29, 2025
Tracked Since
Feb 18, 2026