PT-2020-13605 · Lantronix · Xport Edge

Kelly Leuschner · Published 2020-12-17 · Updated 2022-10-05 · CVE-2020-13528

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lantronix XPort EDGE versions 3.0.0.0R11 through 4.2.0.0R7

Description An information disclosure issue exists in the Web Manager and telnet CLI functionality. A specially crafted HTTP request can cause information disclosure. An attacker can sniff the network to trigger this issue.

Recommendations For versions 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12, and 4.2.0.0R7, consider disabling the Web Manager and telnet CLI functionality until a patch is available. Restrict access to the network to minimize the risk of exploitation. Avoid using the vulnerable functionality in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-13528

Affected Products

Xport Edge

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-13528 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13528 · Vendor Advisory
• https://t.me/cibsecurity/21030 · Telegram Post
• https://t.me/cvenotify/7528 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1136 · Note