Keysight Ixia Vision multiple critical vulnerabilities disclosed
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Five vulnerabilities in Keysight Ixia Vision allow remote code execution, file manipulation, and decryption via hardcoded cryptographic keys.
Keysight has disclosed five vulnerabilities affecting the Ixia Vision Product Family (version 6.3.1 and earlier), reported by NATO NCSC. The most critical is CVE-2025-24525 (CVSS 8.7), a hardcoded cryptographic key vulnerability allowing attackers to intercept or decrypt API calls and authentication payloads without authentication. Four path-traversal and XML entity injection flaws require privileged device admin credentials but enable remote code execution, arbitrary file download, and file deletion in combination with upload functionality. CVE-2025-24494 (CVSS 8.6) is the highest-severity authenticated path-traversal leading to RCE; CVE-2025-24521, CVE-2025-21095, and CVE-2025-23416 (all CVSS 6.9) enable file operations and data exfiltration. Remediation ranges from version 6.7.0 (October 2024) through 6.9.1 (September 2025) depending on the vulnerability. CISA reports no active exploitation in the wild. Network isolation and VPN segmentation are advised; defenders should prioritize replacing default TLS certificates and upgrading immediately.
Mentioned in this report
Detection guidance
Successful Web Request Containing Directory Traversal Sequences
Detects HTTP requests with plain or encoded ../ traversal sequences that return 200, matching the path-traversal exploitation pattern described for the Ixia Vision management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Successful Web Request Containing Directory Traversal Sequences
id: ab9c0b81-9d37-569d-8346-4604cbd2d2b6
status: experimental
description: Detects HTTP requests to a web management interface containing plain
or encoded directory traversal sequences that return HTTP 200. Matches the path-traversal
pattern used to download or delete files and reach RCE on network appliances such
as Ixia Vision. Hunt on the appliance management plane, and tune for scanners.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
category: webserver
detection:
selection_uri:
cs-uri|contains:
- ../
- ..\
- ..%2f
- ..%5c
- '%2e%2e%2f'
- '%2e%2e/'
- '%2e%2e%5c'
- ..%252f
selection_status:
sc-status: 200
condition: selection_uri and selection_status
falsepositives:
- Authorised vulnerability scanners run against management interfaces
- Web applications that legitimately pass relative paths in URL parameters
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
Directory Traversal Request Targeting Sensitive Files or Private Keys
Detects web requests combining traversal sequences with sensitive file targets such as passwd, shadow or SSH/TLS private keys, indicating file download exploitation of a management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Directory Traversal Request Targeting Sensitive Files or Private Keys
id: aecf7359-b283-557c-b52f-e0717a84720e
status: experimental
description: Detects web requests that combine directory traversal sequences with
sensitive file targets (system credential files, SSH keys, PEM/TLS private keys).
Matches the arbitrary file download and data exfiltration primitives described for
Ixia Vision path-traversal flaws.
tags:
- attack.credential-access
- attack.t1552.004
- attack.collection
- attack.t1005
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_traversal:
cs-uri|contains:
- ../
- ..\
- ..%2f
- ..%5c
- '%2e%2e%2f'
- '%2e%2e/'
- ..%252f
selection_target:
cs-uri|contains:
- /etc/passwd
- /etc/shadow
- id_rsa
- authorized_keys
- .ssh/
- .pem
- private.key
- '%2fetc%2fpasswd'
- '%2fetc%2fshadow'
condition: selection_traversal and selection_target
falsepositives:
- Penetration tests and authenticated vulnerability scans against the appliance
- Security training or honeypot traffic that deliberately requests these paths
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs