CVE-2025-54766

MEDIUM

KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-54766 has a selected CVSS score of 5.3 (medium).

Description

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

XorMon-NG

Browse Xorux / XorMon-NG

Default status: affected

CVE List1.8 to < 1.9.38affected

References

4