Vulnerability · Published Jul 22, 2025 · Assigned by icscert
CVE-2025-7766Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
High 8.0
In plain English
A high-severity XML external entity in Provisioning Manager from Lantronix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)2.1%top 18.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lantronix | Provisioning Manager | 0 – through 7.10.2 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H