Xorux XorMon-NG up to 1.9.37 API Endpoint incorrect privileged apis

Summaryinfo

A vulnerability was found in Xorux XorMon-NG up to 1.9.37. It has been rated as problematic. This impacts an unknown function of the component API Endpoint. The manipulation leads to incorrect use of privileged apis. This vulnerability is referenced as CVE-2025-54766. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Xorux XorMon-NG up to 1.9.37 and classified as problematic. This issue affects an unknown function of the component API Endpoint. The manipulation with an unknown input leads to a incorrect use of privileged apis vulnerability. Using CWE to declare the problem leads to CWE-648. The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly. Impacted is confidentiality. The summary by CVE is:

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.

The weakness was published by Jim Becher. It is possible to read the advisory at korelogic.com. The identification of this vulnerability is CVE-2025-54766 since 07/28/2025. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.9.38 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Xorux

Name

• XorMon-NG

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.9.11
• 1.9.12
• 1.9.13
• 1.9.14
• 1.9.15
• 1.9.16
• 1.9.17
• 1.9.18
• 1.9.19
• 1.9.20
• 1.9.21
• 1.9.22
• 1.9.23
• 1.9.24
• 1.9.25
• 1.9.26
• 1.9.27
• 1.9.28
• 1.9.29
• 1.9.30
• 1.9.31
• 1.9.32
• 1.9.33
• 1.9.34
• 1.9.35
• 1.9.36
• 1.9.37

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion