USB-Server-LXL Security Flaw: When “Admin” Means “Root” in Disguise!
Beware the USB-Server-LXL! A lowly “admin” can tweak the script /etc/init.d/lighttpd on this IoT device, and voilà—code is executed with root privileges! Thanks to CVE-2025-52361, your humble “admin” account just became a digital Houdini. Remember, with great power comes great responsibility—and maybe a firmware update.
Hot Take:
Oh, the irony! A low-privilege “admin” account with a default password that could topple the mighty “root” user. It’s like a plot twist in a tech-thriller where the underdog wins with a simple SSH login and a little script editing magic. Who knew that ‘admin’ could be the Achilles’ heel for a USB-server on steroids?
Key Points:
- Privilege escalation vulnerability discovered in USB-Server-LXL devices.
- Exploitable via low-privilege ‘admin’ SSH login.
- Editing a specific script leads to arbitrary code execution with root privileges.
- Vulnerability affects devices up to firmware version “v0.0.16 Build 2023-03-13”.
- Patch provided by the manufacturer following disclosure.
Already a member? Log in here