CVE-2025-54766 — KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

CVE-2025-54766

KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information PUBLISHED

Description (CNA)

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.

Affected (CNA)

Vendor / product	Versions
Xorux / XorMon-NG	affected 1.8 before 1.9.38

CWE

CWE-648

References

https://korelogic.com/Resources/Advisories/KL-001-2025-012.txt
https://xormon.com/note190.php

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Jul/15