CVE-2025-54765— KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-54765
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator
Source: NVD (National Vulnerability Database)
Vulnerability Description
An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves administrative level permissions.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
特权API的不正确使用
Source: NVD (National Vulnerability Database)
Vulnerability Title
XORUX XorMon-NG 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
XORUX XorMon-NG是捷克XORUX公司的一个基础设施性能监控平台。 XORUX XorMon-NG存在安全漏洞，该漏洞源于API端点访问控制不当，可能导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-54765
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-54765
请登录查看更多情报信息。
Same Patch Batch · Xorux · 2025-07-28 · 5 CVEs total
| CVE-2025-54767 | KL-001-2025-014: Xorux LPAR2RRD Read Only User Denial of Service | |
| CVE-2025-54768 | KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information | |
| CVE-2025-54769 | KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal | |
| CVE-2025-54766 | KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensi |
IV. Related Vulnerabilities
Same vendor: Xorux
Same weakness: CWE-648
- CVE-2026-41386
OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Boot - CVE-2026-41329
OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context - CVE-2026-35669
OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plug - CVE-2026-35663
OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reco - CVE-2026-35645
OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic op
V. Comments for CVE-2025-54765
No comments yet