CVE-2025-2567 - CVE House

Status published Critical CVE-2025-2567

Lantronix Xport Missing Authentication for Critical Function

9.3 CVSS

Vulnerability Description

An attacker could modify or disable settings, disrupt fuel monitoring and supply chain operations, leading to disabling of ATG monitoring. This would result in potential safety hazards in fuel storage and transportation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2567

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Souvik Kandar from Microsec(microsec.io) reported this vulnerability to CISA.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05

More from Lantronix

View All →

CVE-2025-7766

Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference

High 8.6

CVE-2025-4338

Lantronix Device Installer Improper Restriction of XML External Entity Reference

Medium 6.9

CVE-2023-7237

Lantronix XPort Weak Encoding for Password

Medium 5.7

Affected Vendor

Lantronix

View all reports →

Affected Software

Xport

Vulnerable Versions:

6.5.0.7

Timeline

Official Publish: April 15th, 2025

Last Modified: April 15th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application