Xorux XorMon-NG CVE-2025-5476 BOLA Exporting Config Exposes Credentials

Critical Vulnerability Information 1. Vulnerability Details Affected Vendor: Xorux Affected Product: XorMon-NG Affected Versions: 1.0 and earlier CVE ID: CVE-2025-5476 CWE Classification: CWE-648: Improper Use of Privileged API 2. Vulnerability Description An API endpoint intended for access only by web application administrators is inadvertently exposed in a location accessible to regular read-only users. This endpoint allows exporting device configuration, thereby exposing sensitive information. 3. Technical Description Read-only users can access the device export functionality via an undocumented web application endpoint. This functionality exports a file containing all user password hashes and cloud credentials in plaintext. Attackers can exploit this vulnerability to obtain and attempt to crack password hashes, including those of administrator users. Additionally, attackers can leverage this vulnerability to gain access to cloud infrastructure. 4. Mitigation and Remediation Recommendations Xorux has released version 1.9.3b, which includes a fix for this vulnerability. For more details: https://xorux.com/note108.php 5. Acknowledgments This vulnerability was discovered by Jin Becher of KoreLogic, Inc. 6. Disclosure Timeline 2025-07-17: KoreLogic reached out to Xorux to report multiple vulnerabilities securely. 2025-07-18: Vendor provided a support contact, but did not use PGP. 2025-07-21: KoreLogic submitted detailed information on this vulnerability and four others. 2025-07-23: Vendor confirmed receipt of the report and stated that the issue was fixed, with a new version to be released on 2025-07-25. 2025-07-25: Xorux released an updated version for the affected product. 2025-07-28: KoreLogic publicly disclosed the vulnerability. 7. Proof of Concept (PoC) Examples of curl and gpg commands are provided for testing the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Xorux XorMon-NG CVE-2025-5476 BOLA Exporting Config Exposes Credentials