XML External Entity Vulnerability in Lantronix Device Installer

CVE-2025-4338

What is CVE-2025-4338?

The Lantronix Device Installer is susceptible to XML External Entity (XXE) attacks, which can occur through configuration files fetched from network devices. An attacker exploiting this vulnerability could potentially retrieve sensitive information such as user credentials and may further gain unauthorized access to the network devices. This access allows attackers to alter configurations and could lead to unauthorized modifications on the host machine running the Device Installer software, including exposure of the password hash of the user operating the application.

References