CVE-2025-4338
Lantronix Device Installer Improper Restriction of XML External Entity Reference
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 22, 2025
- Updated
- May 23, 2025
- Reserved
- May 5, 2025
Description
Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N | icscert |
| 3.1 | 6.8 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L | icscert |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
Device InstallerLantronix |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.