CVE-2025-7766

Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.

Score

CVSS 4.0 8.6 High

Status

Deferred - ics-cert@hq.dhs.gov

Published

2025-07-22

Last modified

2025-07-23

Weaknesses

CWE-611

Affected products

• Provisioning Manager (Lantronix)

References

• https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/105906637/Latest+Version+of+Lantronix+Provisioning+Manager+LPM
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-02