CVE-2025-54969: BAE SOCET GXP · Cross-Site Request Forgery (CSRF)
Source CVE Database V5
Not known to be exploited · CVSS 6.1 Medium · fixed in 4.6.0.2 : update BAE SOCET GXP when convenient.
Data as of 26 Oct 2026, 15:59 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- BAE SOCET GXP before 4.6.0.2
- Patch
- Available – fixed in 4.6.0.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-54969, organizations should first apply any available patches or updates from BAE Systems once released for SOCET GXP version 4.6.0.2 or later. In the absence of immediate patches, implement compensating controls such as deploying web application firewalls (WAFs) configured to detect and block CSRF attack patterns targeting the Job Status Service endpoints. Enforce strict Content Security Policy (CSP) headers to limit the execution of malicious scripts. Educate users on the risks of phishing and social engineering, emphasizing caution when clicking unknown links or visiting untrusted websites. Network segmentation can limit exposure of the SOCET GXP services to only trusted internal users. Additionally, monitor logs for unusual or unauthorized requests to the Job Status Service. If feasible, implement custom CSRF tokens or same-site cookie attributes at the application or proxy level as an interim measure. Regular security assessments and penetration testing focused on web service components can help identify residual risks.
Description
An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user into clicking a malicious link or visiting a malicious website may be able to submit requests to the Job Status Service without the user's knowledge.