PT-2025-36719

CVE-2025-24404

Published

2025-09-09

Updated

2025-09-17

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HertzBeat versions prior to 1.7.0

Description An XML injection Remote Code Execution (RCE) vulnerability exists in Apache HertzBeat due to parsing of HTTP sitemap XML responses. An attacker with an authenticated account and access can trigger the vulnerability by adding a monitor that parses XML and returns specially crafted content.

Recommendations Upgrade to version 1.7.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Springkill

Unam4

Zoiltin

Vendors

Affected products

Weakness enumeration