CVE-2023-7237 is a weak credential protection issue in the Lantronix XPort device server configuration manager, version 2.0.0.13. It sends weakly encoded credentials in web request headers. It scores 5.7 (Medium). Lantronix calls XPort a legacy product and points users who need stronger encryption to xPort Edge.
What's affected
Affected: XPort Device Server Configuration Manager version 2.0.0.13, per CISA advisory ICSA-24-023-05.
Fixed: no patch is named. Lantronix told CISA that XPort is an old legacy product not designed for strong encryption or TLS, and encourages users who need stronger encryption to upgrade to xPort Edge.
Source conflict: the CPE data in the NVD record points at the xPort Edge firmware 2.0.0.13, while CISA's advisory names the legacy XPort and recommends xPort Edge as the upgrade. The advisory is the clearer source, so confirm which product you actually run before acting.
The weaknesses are CWE-261 (weak encoding for password) and CWE-326 (inadequate encryption strength). The vector is adjacent network with user interaction, and the impact is high confidentiality only. KEV is false. CISA lists several sectors, including critical manufacturing, energy, healthcare and transportation.
How to check if you're exposed
Identify the device in your asset list and read the product name and software version in the configuration interface. Version 2.0.0.13 on an XPort is the one named by CISA.
Then ask where the device's web interface is used. Credentials sent in encoded but not strongly protected form can be read by anyone who can observe that traffic on the same network segment, so the question is who shares the segment with the person logging in.
What to do now
- Confirm whether you run the legacy XPort or xPort Edge, and check Lantronix documentation for your model.
- Plan a move to xPort Edge where stronger encryption is needed, as Lantronix suggests.
- Limit configuration sessions to a trusted management network, and avoid logging in from shared or untrusted segments.
- Use credentials for these devices that you do not reuse anywhere else, so a captured value has little value.
- Follow CISA's guidance on control system exposure. Follow CISA's general guidance for control systems: keep devices off the internet, put control networks behind firewalls and away from business networks, and use a patched VPN when remote access is needed.
Why it matters
Weak encoding is not encryption. Encoding changes how data looks but anyone can reverse it, so a credential sent that way is close to being sent in the clear. The attacker has to be on the same network path to see it, which is why the vector is adjacent and the score is moderate.
The device is also a reminder that legacy hardware cannot always be fixed by software. When the vendor says a product was not designed for TLS, the realistic fix is network design and replacement, not a patch.
Quick check
Will a patch fix CVE-2023-7237?
No patch is named. Lantronix recommends upgrading to xPort Edge for stronger encryption.
Why is the score only 5.7?
The attacker needs to be on the adjacent network, and a user has to take part by logging in. Impact is limited to confidentiality.
Sources
Last reviewed: 19 October 2026.
