CVE-2025-4338CWE-611

Lantronix Device Installer Improper Restriction of XML External Entity Reference

Medium · published May 22, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00239 · 14.1th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-05-22T23:00Z
EPSS history
Timeline
  • 22 MAY 23:00Z
    Lantronix Device Installer Improper Restriction of XML External Entity Reference
    cvelistv5