CVE-2023-7237

Summary

Lantronix XPort sends weakly encoded credentials within web request headers.

Affected Software

Weaknesses

• CWE-261: CWE-261 Weak Encoding for Password

Workarounds

Lantronix states that XPort is an old legacy product and is not designed for strong encryption or TLS/SSL encryption. Users who require stronger encryption are encouraged to upgrade to xPort Edge. https://www.lantronix.com/products/xport-edge/

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-05
• https://www.lantronix.com/products/xport-edge/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-05
• https://www.lantronix.com/products/xport-edge/

• ←Previous
• Next→