Lantronix Provisioning Manager: Provisioning Manager reads configuration files supplied by the network devices

Impact

Provisioning Manager reads configuration files supplied by the network devices it manages. Because it doesn't lock down XML external entity resolution, a device (or something spoofing one) can hand it a poisoned config file that leads to unauthenticated remote code execution on the host running Provisioning Manager — which typically has admin reach into the whole fleet of Lantronix devices it provisions.

Who can reach it

Attacker needs to get a malicious XML config file processed by Provisioning Manager — either by compromising/spoofing a managed device on the network, or by feeding it a crafted import file if the workflow allows manual uploads.

What to do

Software upgrade of Provisioning Manager to the patched release. This runs on a management workstation/server rather than the appliances themselves, so it's a single upgrade rather than a per-device fleet rollout — but treat it as high priority since it's the box with admin credentials to the whole console-server fleet.

References