CVE-2025-54967: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium · fixed in 4.6.0.3 : update BAE SOCET GXP when convenient.
Data as of 26 Oct 2026, 06:15 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- BAE SOCET GXP before 4.6.0.3
- Patch
- Available – fixed in 4.6.0.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
European organizations should implement the following specific mitigations: 1) Immediately update SOCET GXP to version 4.6.0.3 or later once available to address the vulnerability. 2) Until patches are applied, restrict the opening of XML-based files from untrusted or unknown sources and enforce strict file validation policies. 3) Educate users on the risks of social engineering and malicious file handling, emphasizing caution with files received via email or external media. 4) Employ network-level controls to monitor and restrict unexpected outbound requests from SOCET GXP workstations, potentially using application whitelisting or firewall rules to limit external communications. 5) Conduct regular audits of SOCET GXP usage and monitor logs for unusual activity indicative of exploitation attempts. 6) Coordinate with BAE Systems for any interim mitigations or configuration changes that can disable external entity processing if feasible. 7) Integrate SOCET GXP endpoints into broader endpoint detection and response (EDR) solutions to detect suspicious behaviors related to this vulnerability. These steps go beyond generic advice by focusing on user behavior, network controls, and vendor coordination specific to the affected product and threat vector.
Description
An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in the process.