CVE-2025-54765

KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.

Affected

Xorux · XorMon-NG

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

8.45% chance of exploitation in the next 30 days, 95th percentile

Published

2025-07-28

Updated

2025-11-03

Proof-of-concept exploits (1)

• https://korelogic.com/Resources/Advisories/KL-001-2025-013.txt

Security advisories

• https://xormon.com/note190.php

References

• CVE Record
• NVD entry