1. EXECUTIVE SUMMARY
- CVSS v4 8.6
- ATTENTION: Low attack complexity
- Vendor: Lantronix
- Equipment: Provisioning Manager
- Vulnerability: Improper Restriction of XML External Entity Reference
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to perform a cross-site scripting attack, which could result in remote code execution.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Lantronix products are affected:
- Provisioning Manager: Versions 7.10.2 and prior
3.2 Vulnerability Overview
3.2.1 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
Provisioning Manager is vulnerable to XML External Entity (XXE) attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
CVE-2025-7766 has been assigned to this vulnerability. A CVSS v3.1 base score of 8.0 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-7766. A base score of 8.6 has been calculated; the CVSS vector string is (AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Information Technology
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: United States
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: