CVE-2025-2567 Lantronix CVE debrief

Who should care

OT/ICS operators, fuel storage and transportation teams, industrial security staff, and asset owners using Lantronix XPort in environments where ATG monitoring or other safety-related monitoring depends on the device.

Technical summary

The CISA CSAF advisory for CVE-2025-2567 describes a network-reachable issue with no privileges and no user interaction required (CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA lists affected product coverage as Lantronix XPort firmware >=6.5.0.7 and <7.0.0.3. The impact described in the advisory is operational: an attacker could modify or disable settings, disrupt fuel monitoring and supply chain operations, and disable ATG monitoring, creating potential safety hazards. Update A to the advisory revised mitigation guidance and added a firmware fix link for XPort v8.0.0.0.

Defensive priority

Immediate. Treat as a high-priority OT remediation because the advisory ties the issue to monitoring disruption and safety risk in fuel storage and transportation.

Recommended defensive actions

• Upgrade affected Lantronix XPort devices to firmware v8.0.0.0 as directed in the advisory.
• If firmware upgrade is not immediately possible, follow Lantronix/CISA mitigation guidance and contact Lantronix for assistance.
• Verify whether any deployed XPort units fall within the affected range (>=6.5.0.7 and <7.0.0.3).
• Restrict network access to OT/ICS devices and apply defense-in-depth controls consistent with CISA ICS recommended practices.
• Monitor configuration changes and operational status for ATG and related safety systems after remediation.
• Consider migration planning to XPort Edge, noting that Lantronix states it is immune to these vulnerabilities.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-25-105-05 for Lantronix XPort (published 2025-04-15, updated 2025-04-29). The CSAF lists the affected product as Lantronix XPort: >=6.5.0.7|<7.0.0.3, gives the impact statement about settings tampering and ATG monitoring disruption, and records remediation for firmware v8.0.0.0. Update A specifically says the mitigation section was revised and a firmware fix link was added. The CVSS vector and score are taken from the supplied source metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.