CVE-2025-54968: BAE SOCET GXP Auth Bypass Vulnerability

CVE-2025-54968 Overview

CVE-2025-54968 is a missing authentication vulnerability [CWE-284] affecting BAE Systems SOCET GXP versions before 4.6.0.2. The SOCET GXP Job Service accepts job submissions without requiring authentication. In some deployment configurations, remote attackers can submit jobs to the service over the network. Local users can also submit jobs that execute under the permissions of other users, enabling privilege escalation on shared systems. SOCET GXP is geospatial exploitation software used for analyzing imagery, mapping, and intelligence workflows in defense and intelligence environments.

Critical Impact
Unauthenticated job submission to the SOCET GXP Job Service allows remote code execution and privilege escalation, with high impact to confidentiality, integrity, and availability.

Affected Products

BAE Systems SOCET GXP versions prior to 4.6.0.2
SOCET GXP Job Service component
Geospatial Exploitation Products line by BAE Systems

Discovery Timeline

2025-10-27 - CVE-2025-54968 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54968

Vulnerability Analysis

The SOCET GXP Job Service handles asynchronous job submissions for geospatial processing tasks. The service exposes a job submission interface that does not enforce authentication on incoming requests. Any client capable of reaching the service endpoint can queue jobs for execution.

In configurations where the Job Service listens on a network-accessible interface, remote attackers with low-privileged network access can submit arbitrary jobs. On multi-user installations, local users can craft submissions that execute with the permissions of any user account serviced by the system, breaking the trust boundary between users.

The vulnerability is classified under [CWE-284] Improper Access Control. Because jobs execute with the privileges of the targeted service identity or another user, successful exploitation produces a confidentiality, integrity, and availability impact equivalent to arbitrary code execution under that identity.

Root Cause

The Job Service was designed without an authentication layer in front of its job intake interface. The service trusts the calling client to identify itself honestly and does not validate that the submitter is authorized to act as the user under which the job will run. This omission converts a normal job submission feature into an authentication bypass and privilege escalation primitive.

Attack Vector

The attack vector is network-based with low complexity. An attacker with network reachability to the Job Service endpoint submits a job request directly to the service. In single-user or workstation-style deployments where the service is bound only to localhost, exploitation requires local access. In server or multi-user deployments where the service accepts remote connections, exploitation can be performed by any reachable host without prior credentials beyond network access. Refer to the Geospatial Exploitation CVE Disclosure for vendor-specific technical detail.

Detection Methods for CVE-2025-54968

Indicators of Compromise

Unexpected jobs appearing in the SOCET GXP Job Service queue from unknown sources or originating hosts outside the analyst workstation pool.
Job Service processes spawning child processes or writing files under user accounts that did not submit work interactively.
Network connections to the Job Service listening port from hosts that are not authorized SOCET GXP clients.

Detection Strategies

Enumerate hosts running SOCET GXP versions earlier than 4.6.0.2 and inventory whether the Job Service is exposed beyond the local interface.
Monitor process creation events where the SOCET GXP Job Service is the parent process and the child process runs under a user context that differs from the submitter.
Alert on inbound connections to the Job Service port from non-allowlisted source addresses.

Monitoring Recommendations

Forward host and network telemetry from SOCET GXP servers into a central analytics platform and retain job submission logs for retrospective review.
Baseline normal Job Service activity per user and flag deviations such as off-hours submissions or unusually high job volume.
Track service restarts, configuration changes, and binding interface changes on hosts running the Job Service.

How to Mitigate CVE-2025-54968

Immediate Actions Required

Upgrade BAE SOCET GXP to version 4.6.0.2 or later on all affected workstations and servers.
Restrict network access to the SOCET GXP Job Service port using host firewalls or network segmentation until patching is complete.
Audit existing Job Service queues and execution history for unauthorized submissions prior to the patch.

Patch Information

BAE Systems addresses CVE-2025-54968 in SOCET GXP 4.6.0.2. Consult the Geospatial Exploitation CVE Disclosure for release artifacts and upgrade guidance, and the BAE Systems Product Overview for product context.

Workarounds

Bind the Job Service to the loopback interface only where remote job submission is not required by the workflow.
Place SOCET GXP hosts behind a network segment that blocks inbound traffic to the Job Service from untrusted clients.
On multi-user systems, limit interactive logon to trusted analysts until the upgrade is deployed to reduce local privilege escalation risk.

bash

# Example host firewall restriction (Windows) limiting Job Service access to a management subnet
netsh advfirewall firewall add rule name="SOCET GXP Job Service - Restrict" ^
  dir=in action=block protocol=TCP localport=<job_service_port>
netsh advfirewall firewall add rule name="SOCET GXP Job Service - Allow Mgmt" ^
  dir=in action=allow protocol=TCP localport=<job_service_port> remoteip=10.0.0.0/24