CVE-2025-24404— Apache HertzBeat (incubating): RCE by parse http sitemap xml response
Quick assessment
Affected
Apache Software Foundation Apache HertzBeat (incubating)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache HertzBeat是美国阿帕奇（Apache）公司的一个可以监控各种组件的工具。 Apache HertzBeat 1.7.0之前版本存在安全漏洞，该漏洞源于XML解析漏洞，可能导致远程代码执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-24404
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache HertzBeat (incubating): RCE by parse http sitemap xml response
Source: CVE Program / CVE List V5
Vulnerability Description
XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.
The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability.
This issue affects Apache HertzBeat (incubating): before 1.7.0.
Users are recommended to upgrade to version 1.7.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
XML注入(XPath盲注)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache HertzBeat 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache HertzBeat是美国阿帕奇（Apache）公司的一个可以监控各种组件的工具。 Apache HertzBeat 1.7.0之前版本存在安全漏洞，该漏洞源于XML解析漏洞，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache HertzBeat (incubating) | 0 ~ 1.7.0 | - |
|
II. Public POCs for CVE-2025-24404
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-24404
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-107460
Apache Fesod (Incubating): UrlImageConverter SSRF protection -
CVE-2026-92120
Apache Allura: Oauth1 Replay Attack -
CVE-2026-92119
Apache Allura: REST API Mass Assignment -
CVE-2026-92116
Apache Allura: OAuth1 missing callback validation -
CVE-2026-85499
Apache SkyWalking BanyanDB: Canopy does not enforce readonly
Same weakness: CWE-91
-
CVE-2026-102037
Junos OS: SRX Series: An attacker causes arbitrary configura -
CVE-2026-110084
Adobe Experience Manager | XML Injection (aka Blind XPath In -
CVE-2026-103044
EasyTimeline should not serve image maps as application/xml -
CVE-2026-76979
XML Injection vulnerability -
CVE-2026-65124
NVIDIA Linux Infrastructure Controller XML注入漏洞
V. Comments for CVE-2025-24404
No comments yet