PT-2025-22568 · Lantronix · Lantronix Device Installer

Published 2025-05-22 · Updated 2025-05-22 · CVE-2025-4338

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lantronix Device installer (affected versions not specified)

Description The issue concerns XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. Additionally, an attacker may gain access to the host running the Device Installer software or the password hash of the user running the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-4338

Affected Products

Lantronix Device Installer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-4338 · Security Note
• https://lantronix.com/products/lantronix-provisioning-manager · Note
• https://twitter.com/CVEnew/status/1925691931251601770 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-142-01 · Note