What’s Vulnerable › Vulnerabilities

CVE-2025-15251: beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference

• Severity: medium (CVSS 5.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-30 · updated 2026-06-17
• Weakness: CWE-610

Description

A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/java/com/fastbee/sip/handler/req/ReqAbstractHandler.java of the component SIP Message Handler. The manipulation results in xml external entity reference. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The project owner replied to the issue report: "Okay, we'll handle it as soon as possible."

Affected products

• beecue FastBee: 2.0, 2.1

References

• https://gitee.com/beecue/fastbee/issues/ID7HNZ
• https://gitee.com/beecue/fastbee/issues/ID7HNZ#note_47777408_link
• https://vuldb.com/?ctiid.338641
• https://vuldb.com/?id.338641

Get alerted when CVE-2025-15251 or the next vulnerability affects your stack