What is CVE-2025-24521?

CVE-2025-24521 is a medium-severity vulnerability in Keysight Ixia Vision Product Family, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.9/10. Published 2025-03-05.

How severe is CVE-2025-24521?

Medium severity. CVSS v3 base score is 4.9 out of 10.

XXE in Keysight Ixia Vision Product Family

CVE-2025-24521

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.004 (32.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Keysight Ixia Vision Product Family — versions 6.3.1

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

Frequently asked questions

What is CVE-2025-24521?: CVE-2025-24521 is a medium-severity vulnerability in Keysight Ixia Vision Product Family, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.9/10. Published 2025-03-05.
How severe is CVE-2025-24521?: Medium severity. CVSS v3 base score is 4.9 out of 10.