CVE-2025-7766 HIGH

CVE-2025-7766: Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference

Vendor Lantronix
Product Provisioning Manager
Weakness CWE-611 · XXE
Published July 22, 2025
Last update July 23, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

What the vulnerability does

01Description

Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.

Key dates

02Disclosure timeline

July 22, 2025 CVE published
July 23, 2025 Record updated