proCertum SmartSign CVE-2026-57917

CONCRETE: The attacker must place a crafted XML signature file on the victim's local filesystem (e.g., via phishing or download). The victim must then browse to that file using SmartSign's file selection window; the preview action automatically triggers the XXE parsing before the victim clicks 'Open'. No special configuration settings are required - the vulnerability exists in the default XML parser behavior. Limiting factors: requires the victim to have SmartSign installed and to interact with a malicious file locally; no remote exploitation is possible without user action.

CVSS 4.0 base score 4.8 (medium), with local attack vector (AV:L) and user interaction required (UI:P). The lack of public exploit or CISA KEV listing suggests low real-world exploitation risk. CVSS vector indicates attack complexity is low, and privileges are not required, but the need for the victim to browse to a malicious file locally limits remote exploit vectors. EPSS data not provided; overall risk is low for most enterprises unless untrusted signature files are commonly handled.

An attacker distributes a specially crafted signature file (e.g., via email or download). When a victim opens the SmartSign application and browses to the file in the file selection dialog, the preview automatically triggers the XXE parser. The external entity request is sent to an attacker-controlled server (SSRF) or reads sensitive local files, such as configuration or password hashes.