CVE-2025-54970: BAE SOCET GXP Authentication Bypass Flaw

CVE-2025-54970 Overview

CVE-2025-54970 is a missing authentication vulnerability in BAE Systems SOCET GXP versions before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate incoming requests. Under certain configurations, remote or local users can abort processing jobs or read job information without holding the owner's permissions. The flaw is categorized as improper access control [CWE-284].

Critical Impact
Authenticated network users can disrupt geospatial exploitation workflows and access job data belonging to other users, undermining the integrity of intelligence-processing pipelines.

Affected Products

BAE Systems SOCET GXP versions prior to 4.6.0.2
SOCET GXP Job Status Service component
Deployments where the Job Status Service is reachable over the network

Discovery Timeline

2025-10-27 - CVE-2025-54970 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54970

Vulnerability Analysis

SOCET GXP is a geospatial intelligence exploitation platform used to process imagery, terrain, and mapping data. The product exposes a Job Status Service that tracks long-running processing tasks. This service accepts requests without verifying the identity of the caller.

Any user who can reach the service endpoint can query job metadata or issue abort commands. The service does not compare the requester's identity against the job owner. This breaks the intended per-user isolation model for job control and job information.

The vulnerability affects confidentiality of job information and disrupts availability of individual processing jobs. Job payload data may reveal sensitive imagery references, task parameters, and workflow context that operators expected to remain private to their session.

Root Cause

The root cause is a missing authentication check on the Job Status Service request handler. The service processes requests based on submitted job identifiers alone, without validating that the requester owns the referenced job. This is a classic [CWE-284] Improper Access Control weakness at the service authentication layer.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker with basic access to the environment sends crafted requests to the Job Status Service. By iterating job identifiers, the attacker enumerates active jobs and can either read status information or send abort commands for jobs owned by other users. See the BAE Geospatial Exploitation Products advisory for vendor technical details.

No verified proof-of-concept code has been published for this vulnerability.
Refer to the vendor advisory linked above for authoritative technical details.

Detection Methods for CVE-2025-54970

Indicators of Compromise

Unexpected job abort events in SOCET GXP logs where the requester does not match the job owner
Repeated Job Status Service queries iterating sequential or randomized job identifiers
Access to the Job Status Service endpoint from hosts outside the normal analyst workstation range

Detection Strategies

Correlate Job Status Service request logs with authenticated user sessions to identify unauthenticated or mismatched-owner activity
Alert on high-volume job identifier enumeration patterns from a single source
Monitor for aborted jobs that terminate before their expected completion window

Monitoring Recommendations

Forward SOCET GXP application and service logs to a central SIEM for retention and correlation
Baseline normal Job Status Service request volume per user and alert on statistical deviations
Track network flows to the Job Status Service port and restrict source IP ranges

How to Mitigate CVE-2025-54970

Immediate Actions Required

Upgrade SOCET GXP to version 4.6.0.2 or later on all deployments
Inventory hosts running the Job Status Service and confirm patch status
Restrict network reachability of the Job Status Service to trusted analyst subnets

Patch Information

BAE Systems addressed the vulnerability in SOCET GXP 4.6.0.2. Refer to the Geospatial Exploitation Products CVE-2025-54970 disclosure for the official patch notice and upgrade instructions. Additional product context is available on the BAE Systems Geospatial Exploitation Products page.

Workarounds

Place the Job Status Service behind host-based or network firewall rules limiting access to authenticated analyst workstations
Segment SOCET GXP servers on a dedicated VLAN with strict inbound access control lists
Increase log retention and review for unauthorized job control activity until patching is complete

bash

# Example: restrict Job Status Service access to a trusted subnet on Linux hosts
# Replace <SERVICE_PORT> and <TRUSTED_SUBNET> with site-specific values
iptables -A INPUT -p tcp --dport <SERVICE_PORT> -s <TRUSTED_SUBNET> -j ACCEPT
iptables -A INPUT -p tcp --dport <SERVICE_PORT> -j DROP