CVE-2025-54765
KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.
Reserved 2025-07-28 | Published 2025-07-28 | Updated 2025-07-28 | Assigner KoreLogicCWE-648: Incorrect Use of Privileged APIs
This vulnerability was discovered by Jim Becher of KoreLogic, Inc.
korelogic.com/Resources/Advisories/KL-001-2025-013.txt
xormon.com/note190.php
Support options
