Vulnerability Spotlight: Two vulnerabilities in Lantronix XPort EDGE
Summary: Cisco Talos discovered two vulnerabilities in the Web Manager functionality of Lantronix XPort EDGE, affecting versions 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7, as well as the Lantronix SGX 5150 versions 8.7.0.0R1 and 8.9.0.0R4. One is an authentication bypass (CVE-2020-13527) triggered by a specially crafted HTTP request that can cause increased privileges, and the other is an information disclosure (CVE-2020-13528) in the Web Manager and telnet CLI that an attacker can trigger by sniffing the network.
Key Takeaway: These are wired Ethernet gateways connecting serial devices, so a bypass that raises privileges and a cleartext flaw that leaks data over the wire put the devices behind those gateways in reach of an attacker already on the network.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-13527CVE-2020-13528
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026