Lantronix Provisioning Manager is affected by a critical XML external entity vulnerability that enables unauthenticated remote code execution on vulnerable host systems.

The application improperly restricts XML external entity references within configuration files provided by network devices. This flaw allows an unauthenticated attacker to inject malicious XML, resulting in remote code execution on the host system.

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it grants an attacker the ability to execute arbitrary code with the privileges of the Provisioning Manager service. Given the CVSS score of 8.0, this represents a high-severity threat that could lead to full system compromise, lateral movement across the network, and the exfiltration of sensitive configuration data.

Immediate Action: Update Lantronix Provisioning Manager to version 7.10.4 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor network traffic for unusual XML-formatted configuration uploads or unexpected inbound connections originating from network devices to the Provisioning Manager host.

Compensating Controls: Implement strict network segmentation to limit the devices capable of communicating with the Provisioning Manager interface and utilize a Web Application Firewall to inspect and filter malicious XML payloads.

Public Exploit Available: Yes, a public exploit exists via ExploitDB and a proof-of-concept repository on GitHub.

The risk associated with CVE-2025-7766 is significant due to the potential for unauthenticated remote code execution. Security teams must prioritize the deployment of version 7.10.4 across all affected Lantronix Provisioning Manager instances. Failure to apply this update leaves the environment susceptible to exploitation via readily available attack code.