High severity · published Sep 9, 2025
CVE-2025-24404
Apache HertzBeat (incubating): RCE by parse http sitemap xml response
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.
The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability.
This issue affects Apache HertzBeat (incubating): before 1.7.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AH
Apache HertzBeat (incubating) · Apache Software Foundation
before 1.7.0 · source: vendor
HE
Hertzbeat · Apache
before 1.7.0 · source: NVD
Affected product
AH
Apache HertzBeat (incubating)
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24404
Mailing List
https://lists.apache.org/thread/4ydy3tqbpwmhl79mcj3pxwqz62nggrfd
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/09/06/4
More from Apache HertzBeat (incubating)
8.8
CVE-2025-48208
Apache HertzBeat (incubating): Jmx JNDI injection vulnerability