{"id":"CVE-2025-2567","state":"PUBLISHED","title":"Lantronix Xport Missing Authentication for Critical Function","description":"An attacker could modify or disable settings, disrupt fuel monitoring \nand supply chain operations, leading to disabling of ATG monitoring. \nThis would result in potential safety hazards in fuel storage and \ntransportation.","publishedAt":"2025-04-15T19:59:32.609Z","updatedAt":"2025-04-15T20:09:58.788Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Lantronix Xport"],"affected":[{"vendor":"Lantronix","product":"Xport","defaultStatus":"unaffected","versions":[{"version":"6.5.0.7","status":"affected","lessThanOrEqual":"7.0.0.3","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2567.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-2567","state":"PUBLISHED","datePublished":"2025-04-15T19:59:32.609Z","dateUpdated":"2025-04-15T20:09:58.788Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-03-20T16:56:22.565Z"},"containers":{"cna":{"title":"Lantronix Xport Missing Authentication for Critical Function","descriptions":[{"lang":"en","value":"An attacker could modify or disable settings, disrupt fuel monitoring \nand supply chain operations, leading to disabling of ATG monitoring. \nThis would result in potential safety hazards in fuel storage and \ntransportation."}],"affected":[{"vendor":"Lantronix","product":"Xport","defaultStatus":"unaffected","versions":[{"version":"6.5.0.7","status":"affected","lessThanOrEqual":"7.0.0.3","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-05"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-04-15T19:59:32.609Z"},"credits":[{"lang":"en","type":"finder","value":"Souvik Kandar from Microsec(microsec.io) reported this vulnerability to CISA."}],"source":{"advisory":"ICSA-25-105-05","discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Lantronix recommends users upgrade to their Xport Edge product, which \nbrings in more cutting edge security suite. Xport edge is not affected \nby these vulnerabilities. Users should contact Lantronix directly for \nassistance.\n\n<br>"}],"value":"Lantronix recommends users upgrade to their Xport Edge product, which \nbrings in more cutting edge security suite. Xport edge is not affected \nby these vulnerabilities. Users should contact Lantronix directly for \nassistance."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-15T20:09:34.571034Z","id":"CVE-2025-2567","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-15T20:09:58.788Z"}}]}}}