{"id":10612,"date":"2025-05-07T13:54:20","date_gmt":"2025-05-07T18:54:20","guid":{"rendered":"https:\/\/beaconlab.us\/?post_type=publicacion&#038;p=10612"},"modified":"2025-05-07T13:57:14","modified_gmt":"2025-05-07T18:57:14","slug":"alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/","title":{"rendered":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Producto(s) afectado(s):&nbsp;<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SysAid On-Prem &lt;= 23.3.40<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Descripci\u00f3n<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Se han identificado y corregido tres vulnerabilidades cr\u00edticas en SysAid ITSM, una plataforma ampliamente utilizada para la gesti\u00f3n de servicios de TI. Las fallas, reportadas bajo los identificadores CVE-2025-2775, CVE-2025-2776 ,\u00a0\u00a0y CVE-2025-2777, permiten a un atacante remoto ejecutar c\u00f3digo arbitrario (RCE), eludir mecanismos de autenticaci\u00f3n, escalar privilegio y acceder a informaci\u00f3n sensible del sistema.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Las vulnerabilidades, identificadas como CVE-2025-2775, CVE-2025-2776 y CVE-2025-2777, han sido descritas como inyecciones de entidad externa XML (&nbsp;<a href=\"https:\/\/www.hackerone.com\/knowledge-center\/xxe-complete-guide-impact-examples-and-prevention\" target=\"_blank\" rel=\"noreferrer noopener\">XXE<\/a>&nbsp;), que ocurren cuando un atacante puede interferir con \u00e9xito en el an\u00e1lisis de la entrada XML de una aplicaci\u00f3n.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A continuaci\u00f3n se detallan las vulnerabilidades:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVE-2025-2775\u00a0\u00a0(CVSSv3 9.3)y CVE-2025-2776 (CVSSv3 9.3): Un XXE previamente autenticado dentro del punto final \/mdm\/checkin<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVE-2025-2777 (CVSSv3 9.3): Un XXE previamente autenticado dentro del punto final \/lshw<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVE-2025-2778 (a\u00fan no se confirma): Las fallas XXE podr\u00edan estar asociadas con otra vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo, para lograr la ejecuci\u00f3n remota de c\u00f3digo (RCE). El problema de inyecci\u00f3n de comandos se ha identificado con el identificador CVE-2025-2778.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Soluci\u00f3n<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Se recomienda actualizar SysAid IT on-premise a la \u00faltima versi\u00f3n disponible publicada en mayo de 2025, la version 24.4.60 b16 corrige todas las vulnerabilidades mencionadas.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Las actualizaciones est\u00e1n disponibles en el portal oficial de SysAid:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/documentation.sysaid.com\/docs\/24-40-60\">https:\/\/documentation.sysaid.com\/docs\/24-40-60<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Informaci\u00f3n adicional:<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>https:\/\/thehackernews.com\/2025\/05\/sysaid-patches-4-critical-flaws.html<\/li>\n\n\n\n<li>https:\/\/labs.watchtowr.com\/sysowned-your-friendly-rce-support-ticket\/<\/li>\n\n\n\n<li>https:\/\/www.cve.org\/CVERecord?id=CVE-2025-2775<\/li>\n\n\n\n<li>https:\/\/www.cve.org\/CVERecord?id=CVE-2025-2776<\/li>\n\n\n\n<li><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-2777\">https:\/\/www.cve.org\/CVERecord?id=CVE-2025-2777<\/a><\/li>\n\n\n\n<li>https:\/\/www.cve.org\/CVERecord?id=CVE-2025-2778<\/li>\n<\/ul>\n","protected":false},"featured_media":10615,"template":"","class_list":["post-10612","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":{"activar_pdf_link":true,"pdf":10619,"numero_de_boletin":"33","traffic_light_protocol":"White"},"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Producto(s) afectado(s): SysAid On-Prem\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"es_ES\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT - Beacon Lab\" \/>\n\t\t<meta property=\"og:description\" content=\"Producto(s) afectado(s): SysAid On-Prem\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/05\/493834234_1107521901414334_6332819541165886599_n.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/05\/493834234_1107521901414334_6332819541165886599_n.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1272\" \/>\n\t\t<meta property=\"og:image:height\" content=\"1272\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-05-07T18:54:20+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-05-07T18:57:14+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT - Beacon Lab\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Producto(s) afectado(s): SysAid On-Prem\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/05\/493834234_1107521901414334_6332819541165886599_n.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#listItem\",\"name\":\"Alerta 2025-33 Vulnerabilidades Cr\\u00edticas en SysAid IT\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#listItem\",\"position\":2,\"name\":\"Alerta 2025-33 Vulnerabilidades Cr\\u00edticas en SysAid IT\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/\",\"name\":\"Alerta 2025-33 Vulnerabilidades Cr\\u00edticas en SysAid IT - Beacon Lab\",\"description\":\"Producto(s) afectado(s): SysAid On-Prem\",\"inLanguage\":\"es-ES\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/493834234_1107521901414334_6332819541165886599_n.jpg\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#mainImage\",\"width\":1272,\"height\":1272,\"caption\":\"sysaid it\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/publicacion\\\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\\\/#mainImage\"},\"datePublished\":\"2025-05-07T13:54:20-06:00\",\"dateModified\":\"2025-05-07T13:57:14-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"es-ES\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/es\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT - Beacon Lab","description":"Producto(s) afectado(s): SysAid On-Prem","canonical_url":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/es\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/es\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#listItem","name":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#listItem","position":2,"name":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/es\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/es\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/es\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#webpage","url":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/","name":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT - Beacon Lab","description":"Producto(s) afectado(s): SysAid On-Prem","inLanguage":"es-ES","isPartOf":{"@id":"https:\/\/beaconlab.us\/es\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/05\/493834234_1107521901414334_6332819541165886599_n.jpg","@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#mainImage","width":1272,"height":1272,"caption":"sysaid it"},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/#mainImage"},"datePublished":"2025-05-07T13:54:20-06:00","dateModified":"2025-05-07T13:57:14-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/es\/#website","url":"https:\/\/beaconlab.us\/es\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"es-ES","publisher":{"@id":"https:\/\/beaconlab.us\/es\/#organization"}}]},"og:locale":"es_ES","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT - Beacon Lab","og:description":"Producto(s) afectado(s): SysAid On-Prem","og:url":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/05\/493834234_1107521901414334_6332819541165886599_n.jpg","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/05\/493834234_1107521901414334_6332819541165886599_n.jpg","og:image:width":1272,"og:image:height":1272,"article:published_time":"2025-05-07T18:54:20+00:00","article:modified_time":"2025-05-07T18:57:14+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT - Beacon Lab","twitter:description":"Producto(s) afectado(s): SysAid On-Prem","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/05\/493834234_1107521901414334_6332819541165886599_n.jpg"},"aioseo_meta_data":{"post_id":"10612","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2025-05-07 18:54:21","updated":"2025-09-24 06:42:51","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/es\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/es\/"},{"label":"Alerta 2025-33 Vulnerabilidades Cr\u00edticas en SysAid IT","link":"https:\/\/beaconlab.us\/es\/publicacion\/alerta-2025-33-vulnerabilidades-criticas-en-sysaid-it\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/es\/wp-json\/wp\/v2\/publicacion\/10612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/es\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/es\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":2,"href":"https:\/\/beaconlab.us\/es\/wp-json\/wp\/v2\/publicacion\/10612\/revisions"}],"predecessor-version":[{"id":10621,"href":"https:\/\/beaconlab.us\/es\/wp-json\/wp\/v2\/publicacion\/10612\/revisions\/10621"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/es\/wp-json\/wp\/v2\/media\/10615"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/es\/wp-json\/wp\/v2\/media?parent=10612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}