CVE-2025-54768

🗓️ 28 Jul 2025 23:31:09Reported by KoreLogicType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

API endpoint exposes logs to unauthorized users, risking sensitive information access.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-54768	29 Jul 202500:16	–	circl
CNNVD	XORUX LPAR2RRD 安全漏洞	29 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-54768 KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information	28 Jul 202523:31	–	cvelist
EUVD	EUVD-2025-22957	3 Oct 202520:07	–	euvd
KoreLogic Security	Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information	28 Jul 202500:00	–	korelogic
NVD	CVE-2025-54768	29 Jul 202500:15	–	nvd
OSV	CVE-2025-54768	29 Jul 202500:15	–	osv
Packet Storm	📄 Xorux LPAR2RRD 8.04 Information Disclosure	29 Jul 202500:00	–	packetstorm
Positive Technologies	PT-2025-31158 · Xorux · Lpar2Rrd	28 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-54768	30 Jul 202523:40	–	redhatcve

NVD

Node

xorux lpar2rrdRange≤8.04

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Linux"
    ],
    "product": "LPAR2RRD",
    "vendor": "Xorux",
    "versions": [
      {
        "status": "affected",
        "version": "8.04"
      }
    ]
  }
]

Source	Link
lpar2rrd	www.lpar2rrd.com/note800.php
korelogic	www.korelogic.com/Resources/Advisories/KL-001-2025-015.txt
seclists	www.seclists.org/fulldisclosure/2025/Jul/18

Parameter	Position	Path	Description	CWE
cmd	query param	lpar2rrd-cgi/vmwcfg.sh	API endpoint intended for admin use is accessible by read-only users, allowing download of appliance logs and exposure of sensitive information.	CWE-648

17 Jun 2026 09:40Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3

EPSS0.03976

SSVC

CWE-648