Vulnerability · Published May 22, 2025 · Assigned by icscert
CVE-2025-4338Lantronix Device Installer Improper Restriction of XML External Entity Reference
Medium 6.8
In plain English
A medium-severity XML external entity in Device Installer from Lantronix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lantronix | Device Installer | 0 – through 4.4.0.7 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L