CVE-2025-54768

🗓️ 28 Jul 2025 23:31:09Reported by KoreLogicType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

API endpoint exposes logs to unauthorized users, risking sensitive information access.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-54768	29 Jul 202500:16	–	circl
CNNVD	XORUX LPAR2RRD 安全漏洞	29 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-54768 KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information	28 Jul 202523:31	–	cvelist
EUVD	EUVD-2025-22957	3 Oct 202520:07	–	euvd
KoreLogic Security	Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information	28 Jul 202500:00	–	korelogic
NVD	CVE-2025-54768	29 Jul 202500:15	–	nvd
Packet Storm	📄 Xorux LPAR2RRD 8.04 Information Disclosure	29 Jul 202500:00	–	packetstorm
Positive Technologies	PT-2025-31158 · Xorux · Lpar2Rrd	28 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-54768	30 Jul 202523:40	–	redhatcve
Vulnrichment	CVE-2025-54768 KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information	28 Jul 202523:31	–	vulnrichment

NVD

Node

xorux lpar2rrdRange≤8.04

[
  {
    "defaultStatus": "affected",
    "platforms": [
      "Linux"
    ],
    "product": "LPAR2RRD",
    "vendor": "Xorux",
    "versions": [
      {
        "status": "affected",
        "version": "8.04"
      }
    ]
  }
]

Source	Link
korelogic	www.korelogic.com/Resources/Advisories/KL-001-2025-015.txt
lpar2rrd	www.lpar2rrd.com/note800.php
seclists	www.seclists.org/fulldisclosure/2025/Jul/18

Parameter	Position	Path	Description	CWE
cmd	query param	lpar2rrd-cgi/vmwcfg.sh?cmd=logs	API endpoint intended for administrators can be accessed by read-only users to download logs containing sensitive data	CWE-648

03 Nov 2025 20:19Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3

EPSS0.00434

SSVC

CWE-648