# Keysight Ixia Vision multiple critical vulnerabilities disclosed

Published: 2025-09-30 · Severity: routine · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/9f0d40b3-64a6-5d6b-9631-e8bba8b3a171/keysight-ixia-vision-multiple-critical-vulnerabilities-disclosed

> Five vulnerabilities in Keysight Ixia Vision allow remote code execution, file manipulation, and decryption via hardcoded cryptographic keys.

Keysight has disclosed five vulnerabilities affecting the Ixia Vision Product Family (version 6.3.1 and earlier), reported by NATO NCSC. The most critical is CVE-2025-24525 (CVSS 8.7), a hardcoded cryptographic key vulnerability allowing attackers to intercept or decrypt API calls and authentication payloads without authentication. Four path-traversal and XML entity injection flaws require privileged device admin credentials but enable remote code execution, arbitrary file download, and file deletion in combination with upload functionality. CVE-2025-24494 (CVSS 8.6) is the highest-severity authenticated path-traversal leading to RCE; CVE-2025-24521, CVE-2025-21095, and CVE-2025-23416 (all CVSS 6.9) enable file operations and data exfiltration. Remediation ranges from version 6.7.0 (October 2024) through 6.9.1 (September 2025) depending on the vulnerability. CISA reports no active exploitation in the wild. Network isolation and VPN segmentation are advised; defenders should prioritize replacing default TLS certificates and upgrading immediately.

## Mentioned in this report

- Vulnerabilities: CVE-2025-21095, CVE-2025-23416, CVE-2025-24494, CVE-2025-24521, CVE-2025-24525

## Detection guidance (public sample)

### Successful Web Request Containing Directory Traversal Sequences

ATT&CK: T1190

Detects HTTP requests with plain or encoded ../ traversal sequences that return 200, matching the path-traversal exploitation pattern described for the Ixia Vision management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Successful Web Request Containing Directory Traversal Sequences
id: ab9c0b81-9d37-569d-8346-4604cbd2d2b6
status: experimental
description: Detects HTTP requests to a web management interface containing plain
  or encoded directory traversal sequences that return HTTP 200. Matches the path-traversal
  pattern used to download or delete files and reach RCE on network appliances such
  as Ixia Vision. Hunt on the appliance management plane, and tune for scanners.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
    - ../
    - ..\
    - ..%2f
    - ..%5c
    - '%2e%2e%2f'
    - '%2e%2e/'
    - '%2e%2e%5c'
    - ..%252f
  selection_status:
    sc-status: 200
  condition: selection_uri and selection_status
falsepositives:
- Authorised vulnerability scanners run against management interfaces
- Web applications that legitimately pass relative paths in URL parameters
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
```

### Directory Traversal Request Targeting Sensitive Files or Private Keys

ATT&CK: T1552.004

Detects web requests combining traversal sequences with sensitive file targets such as passwd, shadow or SSH/TLS private keys, indicating file download exploitation of a management interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Directory Traversal Request Targeting Sensitive Files or Private Keys
id: aecf7359-b283-557c-b52f-e0717a84720e
status: experimental
description: Detects web requests that combine directory traversal sequences with
  sensitive file targets (system credential files, SSH keys, PEM/TLS private keys).
  Matches the arbitrary file download and data exfiltration primitives described for
  Ixia Vision path-traversal flaws.
tags:
- attack.credential-access
- attack.t1552.004
- attack.collection
- attack.t1005
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri|contains:
    - ../
    - ..\
    - ..%2f
    - ..%5c
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%252f
  selection_target:
    cs-uri|contains:
    - /etc/passwd
    - /etc/shadow
    - id_rsa
    - authorized_keys
    - .ssh/
    - .pem
    - private.key
    - '%2fetc%2fpasswd'
    - '%2fetc%2fshadow'
  condition: selection_traversal and selection_target
falsepositives:
- Penetration tests and authenticated vulnerability scans against the appliance
- Security training or honeypot traffic that deliberately requests these paths
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9f0d40b3-64a6-5d6b-9631-e8bba8b3a171/keysight-ixia-vision-multiple-critical-vulnerabilities-disclosed.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup