1. EXECUTIVE SUMMARY
- CVSS v4 6.9
- ATTENTION: Low attack complexity
- Vendor: Lantronix
- Equipment: Device Installer
- Vulnerability: Improper Restriction of XML External Entity Reference
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to gain access to the host machine running the Device Installer software.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Lantronix products are affected:
- Device Installer: Versions 4.4.0.7 and prior
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
Lantronix Device installer is vulnerable to XML External Entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.
CVE-2025-4338 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L).
A CVSS v4 score has also been calculated for CVE-2025-4338. A base score of 6.9 has been calculated; the CVSS vector string is (AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Information Technology Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: