CVE-2025-7766

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-77675.4A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue CVE-2025-77689.3Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative acces CVE-2025-77698.7Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is cal CVE-2025-77708.7Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predicta CVE-2025-77718.7ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the Mm CVE-2025-77726.5The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all vers CVE-2025-77738.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an inte CVE-2025-77748.8A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a CVE-2025-77759.8Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScale CVE-2025-77769.8Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway wh CVE-2025-77776.5The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform maliciou CVE-2025-77789.8The Icons Factory plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient authorization and improper path validati