CVE-2025-54967 is an XML External Entity (XXE) vulnerability found in BAE Systems' SOCET GXP software versions before 4.6.0.3. SOCET GXP is a geospatial analysis tool used primarily by defense, intelligence, and governmental organizations for processing and analyzing imagery and geospatial data. The vulnerability arises because the software improperly processes XML-based files that contain external entity references. When a user is socially engineered into opening a maliciously crafted XML file, the software processes these external entities, which can trigger outbound network requests. These outbound requests can be used by an attacker to exfiltrate sensitive information from the victim's environment or perform other network reconnaissance activities. The attack vector requires user interaction (opening the malicious file) and social engineering, but does not require prior authentication. No CVSS score has been assigned yet, and no public patches or exploits are currently known. The lack of patch availability means organizations must rely on configuration changes and user awareness to mitigate risk. Given the nature of SOCET GXP’s use in sensitive environments, this vulnerability poses a significant risk to confidentiality and potentially integrity of sensitive geospatial data.

For European organizations, especially those in defense, intelligence, and governmental sectors, this vulnerability could lead to unauthorized disclosure of sensitive geospatial and intelligence data. Such data leaks could compromise national security operations, intelligence missions, and critical infrastructure planning. The vulnerability’s reliance on social engineering means targeted spear-phishing or malicious file distribution campaigns could be effective. The impact on confidentiality is high, as outbound requests could leak internal network details or sensitive file contents. Integrity and availability impacts are less direct but could arise if attackers leverage the vulnerability for further network intrusion. European organizations that rely on SOCET GXP for mission-critical geospatial analysis are particularly at risk, potentially affecting operational security and strategic decision-making.

1. Immediately educate SOCET GXP users about the risks of opening unsolicited or unexpected XML-based files, emphasizing social engineering awareness. 2. Disable XML external entity processing in SOCET GXP’s configuration if possible, or apply XML parser hardening to prevent external entity resolution. 3. Monitor network traffic for unusual outbound requests originating from SOCET GXP clients, especially to unknown or suspicious external domains. 4. Implement strict file validation and sandboxing for files opened within SOCET GXP to detect and block malicious content. 5. Maintain strict access controls and network segmentation to limit data exposure if exploitation occurs. 6. Engage with BAE Systems for updates and patches, and apply them promptly once available. 7. Use endpoint detection and response (EDR) tools to detect anomalous behaviors related to this vulnerability. 8. Incorporate this vulnerability into threat hunting and incident response playbooks for relevant teams.