CVE-2025-7766: Lantronix Provisioning Manager RCE Flaw

CVE-2025-7766 Overview

CVE-2025-7766 is an XML External Entity (XXE) vulnerability in Lantronix Provisioning Manager. The application parses configuration files supplied by network devices without disabling external entity resolution. An attacker on an adjacent network can deliver a crafted configuration file that triggers unauthenticated remote code execution on the host running Provisioning Manager. The flaw is tracked under CWE-611: Improper Restriction of XML External Entity Reference and is documented in CISA ICS Advisory ICSA-25-203-02.

Critical Impact
Unauthenticated attackers on an adjacent network can achieve remote code execution on Windows hosts running Lantronix Provisioning Manager by supplying malicious XML configuration data from a controlled or spoofed network device.

Affected Products

Lantronix Provisioning Manager (LPM) — versions prior to the fixed release noted in the vendor advisory
Hosts running LPM that discover and provision Lantronix network devices
Environments where LPM communicates with untrusted devices on the local network segment

Discovery Timeline

2025-07-22 - CVE-2025-7766 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-7766

Vulnerability Analysis

Lantronix Provisioning Manager processes XML configuration data returned by discovered network devices. The XML parser used by LPM resolves external entity references during document parsing. Because LPM trusts the device-supplied XML, an attacker who can respond to a discovery or provisioning request can inject a crafted XML document containing external entity declarations.

XXE flaws of this class typically permit local file disclosure, server-side request forgery, and denial of service. In LPM, the parser behavior is reachable through the configuration ingest path and produces unauthenticated remote code execution on the host. No credentials or user authentication are required, though the attacker must reside on an adjacent network and the LPM operator must initiate or accept the device interaction.

Root Cause

The root cause is an XML parser configuration that fails to disable Document Type Definition (DTD) processing and external entity resolution. When LPM deserializes a configuration document, the parser expands attacker-controlled <!ENTITY> declarations and SYSTEM references. This expansion grants the attacker primitives that LPM converts into code execution within its trust context.

Attack Vector

An attacker positioned on the same broadcast or routed segment as an LPM workstation impersonates or compromises a Lantronix device. When the LPM operator scans for devices or imports configuration, the malicious device returns an XML payload containing crafted external entity declarations. The LPM XML parser resolves these entities and triggers the exploitation chain leading to code execution on the operator host.

The vulnerability manifests during configuration parsing. Refer to the Lantronix Provisioning Manager Update advisory and CISA ICS Advisory ICSA-25-203-02 for technical details. A proof-of-concept reference is tracked under the exploitdb-available tag.

Detection Methods for CVE-2025-7766

Indicators of Compromise

Unexpected outbound connections from LPM hosts to attacker-controlled URLs immediately after a device discovery or provisioning operation
Child processes spawned by the LPM executable that do not match normal provisioning workflow binaries
XML configuration payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM references received from network devices
New persistence artifacts (scheduled tasks, registry Run keys, services) created on engineering or operator workstations running LPM

Detection Strategies

Inspect network traffic to and from LPM hosts for XML payloads containing DTD declarations or external entity references
Hunt for process lineage where the LPM process is the parent of cmd.exe, powershell.exe, rundll32.exe, or scripting interpreters
Correlate file write events in user temp directories with LPM activity windows
Alert on LPM hosts initiating SMB, HTTP, or FTP requests to non-corporate destinations following a provisioning session

Monitoring Recommendations

Enable command-line and process-creation logging on all workstations where LPM is installed
Capture and retain packet metadata on management VLANs used by LPM to support retrospective hunts
Forward endpoint telemetry from LPM operator hosts to a centralized SIEM or data lake for correlation
Track installed LPM versions across the fleet and alert when out-of-date instances launch

How to Mitigate CVE-2025-7766

Immediate Actions Required

Upgrade Lantronix Provisioning Manager to the fixed version listed in the vendor advisory
Restrict LPM execution to dedicated, segmented management workstations that do not handle email or general web browsing
Remove LPM from any host where it is not actively required for device provisioning
Audit recent LPM use and review endpoint telemetry from those sessions for signs of exploitation

Patch Information

Lantronix has released an updated build of Provisioning Manager that addresses the XXE flaw. Administrators should download and deploy the latest LPM version from the Lantronix Provisioning Manager Update page and verify the installed version on every operator workstation. CISA tracks the remediation guidance in ICSA-25-203-02.

Workarounds

Isolate LPM workstations on a dedicated management VLAN with no untrusted devices present during provisioning
Only operate LPM against devices that are physically controlled and verified before discovery
Block LPM hosts from initiating outbound internet connections at the firewall to limit second-stage payload retrieval
Disable or uninstall LPM until patching is complete on hosts that cannot be segmented