CVE-2025-54967

MEDIUM

BAE SOCET GXP < 4.6.0.3 - XML External Entity Injection in XML File Processing

Title source: llm

Description

An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in the process.

References (2)

Core 2

Core References

Product

https://www.baesystems.com/en-us/product/geospatial-exploitation-products

Vendor Advisory

https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54967

Scores

CVSS v3 6.5

EPSS 0.0033

EPSS Percentile 25.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

baesystems/socet_gxp < 4.6.0.3

Published Oct 27, 2025

Tracked Since Feb 18, 2026