CVE Alert: CVE-2025-2776 - SysAid - SysAid On-Prem - https://www.redpacketsecurity.com/cve-alert-cve-2025-2776-sysaid-sysaid-on-prem/

#OSINT #ThreatIntel #CyberSecurity #cve-2025-2776 #sysaid #sysaid-on-prem

CVE Alert: CVE-2025-2775 - SysAid - SysAid On-Prem - https://www.redpacketsecurity.com/cve-alert-cve-2025-2775-sysaid-sysaid-on-prem/

#OSINT #ThreatIntel #CyberSecurity #cve-2025-2775 #sysaid #sysaid-on-prem

Critical vulnerabilities discovered in SysAid's on-premise IT support software

💥 Vulnerability: XML External Entity (XXE) injections that can lead to RCE

⚠️ Impact: Retrieval of sensitive files, full admin access, and arbitrary code execution, risking data breaches and system compromises.

🔍 CVEs: CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778

🔧 Remediation: Update to SysAid version 24.4.60 b16

#cybersecurity #SysAid #vulnerabilitymanagement

https://thehackernews.com/2025/05/sysaid-patches-4-critical-flaws.html

#BSI WID-SEC-2025-0981: [NEU] [hoch] ##SysAid #Technologies #Ltd SysAid: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SysAid Technologies Ltd SysAid ausnutzen, um Informationen offenzulegen.

https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0981

Details techniques & IoCs pour la vulnérabilité dans le logiciel de gestion On-prem SysAid CVE-2023-47246 dans ce récit de prise en charge d'incident de sécurité
👇
https://profero.io/posts/sysaidonpremvulnerability/

------------
if sophos 😱 🏃‍♂️ 💨
👇
foreach($s in tasklist) {
if ($s -match '^(Sophos).*\.exe\s') {echo $s; $bp++;}
}
if ($bp) { echo "`nSTOP-PROCs FOUND! Exiting`n" }
------------

#Cyberveille #SysAid

The write up for our observations and a bit about the POCs the @huntress team got working for the #SysAid #0day used by #clop #cl0p

Awesome work by @JohnHammond Matt Kiely and others

#dfir

https://www.huntress.com/blog/critical-vulnerability-sysaid-cve-2023-47246

This was a fun one! Great work by @JohnHammond and the rest of the @huntress crew!

#dfir #malware #clop #CL0P #SysAid

Following the exploitation of the vulnerability, Lace Tempest used the compromised SysAid software to issue commands for delivering a malware loader associated with the Gracewire malware.

#Cybersecurity #Vulnerability #Exploit #ZeroDay #SysAid

https://cybersec84.wordpress.com/2023/11/09/critical-lace-tempest-exploits-sysaid-zero-day-vulnerability/

Clop is back, now exploiting a new zero-day in SysAid IT support software. A patch has been released for CVE-2023-47246

#SysAid #MoveIt #Clop

https://therecord.media/clop-ransomware-gang-targets-new-zero-day