Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-7766. PoCs published by Byte Reaper, byteReaper77.
AI-analyzed exploit summary This exploit demonstrates an XXE (XML External Entity) injection vulnerability in Lantronix Provisioning Manager ≤ 7.10.3. It allows an attacker to read arbitrary files (e.g., /etc/passwd) or trigger outbound HTTP requests to an attacker-controlled server.
Description
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
Exploits (2)
This exploit demonstrates an XXE (XML External Entity) injection vulnerability in Lantronix Provisioning Manager ≤ 7.10.3. It allows an attacker to read arbitrary files (e.g., /etc/passwd) or trigger outbound HTTP requests to an attacker-controlled server.
This repository contains a functional exploit for CVE-2025-7766, demonstrating an XXE vulnerability that allows reading files (e.g., /etc/passwd) and triggering out-of-band HTTP callbacks. The exploit is written in C and uses libcurl to send crafted XML payloads to a target endpoint.
References (2)
Scores
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H