Log in Start free

Vulnerability · Published Dec 30, 2025 · Assigned by VulDB

CVE-2025-15251beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference

Medium 5.6

In plain English

A medium-severity XML external entity in FastBee from beecue. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.3%top 73.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/java/com/fastbee/sip/handler/req/ReqAbstractHandler.java of the component SIP Message Handler. The manipulation results in xml external entity reference. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The project owner replied to the issue report: "Okay, we'll handle it as soon as possible."

Affected products (as reported)

VendorProductVersions
beecue FastBee 2.02.1

Weakness: CWE-611, CWE-610 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References