EUVD-2025-25647Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
AnalysisAI
IBM QRadar SIEM versions 7.5 through 7.5.0 Update Package 12 contain an XML External Entity (XXE) injection vulnerability that allows authenticated remote attackers to extract sensitive information or trigger denial-of-service conditions through memory exhaustion. The vulnerability requires valid credentials (CVSS PR:L) but has a high confidentiality impact (C:H) and affects a critical security infrastructure product. No publicly available evidence of active exploitation or public POCs has been confirmed at this time.
Technical ContextAI
The vulnerability exists in QRadar's XML parsing functionality, which fails to disable external entity processing in its XML parser. This is a classic XXE attack vector (CWE-611: Improper Restriction of XML External Entity Reference) where an attacker can craft malicious XML payloads containing DOCTYPE declarations with SYSTEM or PUBLIC identifiers pointing to local files or external resources. The affected component processes user-supplied XML data without proper input validation or entity resolution restrictions. Affected CPE: cpe:2.3:a:ibm:qradar_siem:7.5:*:*:*:*:*:*:* through cpe:2.3:a:ibm:qradar_siem:7.5.0:up12:*:*:*:*:*:*. This impacts QRadar's core XML parsing libraries, likely in data ingestion, log processing, or API handling components.
RemediationAI
- Upgrade to IBM QRadar SIEM 7.5.0 Update Package 13 or later (specific patch version should be confirmed via IBM Security Bulletin). 2. If immediate patching is unavailable, implement network-level access controls to restrict XML data ingestion to trusted sources only. 3. Review and audit QRadar user access controls; disable unnecessary user accounts with API or data ingestion privileges. 4. Monitor QRadar logs for XML parsing errors or suspicious DOCTYPE declarations in ingested data. 5. Apply input validation rules at the firewall/proxy level to block XML payloads containing SYSTEM, PUBLIC, or ENTITY declarations if possible. 6. Contact IBM Security for the specific patch advisory (likely published via IBM X-Force Exchange or QRadar Security Bulletin system).
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. Rat
IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecur
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. Rated high severity (CVSS 8.
IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a local user to gain escalated privileges due to weak file permissions. Ra
IBM QRadar 7.3.0 to 7.3.3 Patch 2 contains hard-coded credentials, such as a password or cryptographic key, which it use
Unspecified vulnerability in IBM Security QRadar SIEM 7.1 MR2 and 7.2 MR2 allows remote attackers to execute arbitrary c
IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to Server Side Request Forgery (SSRF). Rated medium severity (CVSS 6.3),
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to send a specially crafted command which would be e
IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. Rated hi
IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to access data and perform unauthorized actions due
Share
External POC / Exploit Code
Leaving vuln.today