The OpenNMS Group's Meridian and Horizon products contain an XXE vulnerability (CWE-611) in their XML collector. When collecting XML data from an attacker-controlled source, the XML parser resolves external entities and external DTDs, enabling attackers to read files accessible to the OpenNMS service account and induce out-of-band requests. This vulnerability affects Meridian versions from 2024.1.0 up to but not including 2024.3.13, 2025.0.0 up to but not including 2025.0.10, and Horizon versions from 36.0.0 up to but not including 36.0.4. The vendor recommends upgrading to Meridian 2024.3.13, 2025.0.10, or Horizon 36.0.4 or newer to remediate the issue.

An attacker who can control the XML data source processed by the OpenNMS XML collector can exploit this vulnerability to read sensitive files accessible by the OpenNMS service account, including database credentials. Additionally, the attacker can cause the system to make out-of-band network requests, potentially leading to further information disclosure or network-based attacks. The CVSS score of 5.9 (medium severity) reflects the network attack vector with high impact on confidentiality but no impact on integrity or availability.

A fix is available by upgrading to Meridian versions 2024.3.13 or 2025.0.10 and Horizon version 36.0.4 or later. Organizations should apply these updates promptly. Additionally, since these products are intended for use within private networks and not exposed directly to the Internet, ensure that deployment follows this guidance to reduce exposure. Patch status is confirmed by the vendor advisory.