CVE-2025-67036
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An issue was discovered in Lantronix EDS5000 2.1.0.0R3 where the Log Info page lacks sanitization of the file name parameter. This allows an authenticated attacker to inject arbitrary OS commands executed with root privileges.
Risk Assessment
An attacker can gain full control over the device, compromising data confidentiality, integrity, and availability, and potentially using the device as an entry point into the internal network.
Recommendation
Immediately update the firmware of Lantronix EDS5000 devices to the latest version that fixes this vulnerability. Until the update, restrict management interface access to trusted IP addresses only.
Other vulnerabilities in Lantronix EDS5000
See all- CVE-2025-67038CriticalActively exploited
In Lantronix EDS5000 version 2.1.0.0R3, the HTTP RPC module executes a shell command to write logs when user authentication fails. The username is directly concatenated with the command without any sanitization, allowing attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
- CVE-2025-67037High
An issue was discovered in Lantronix EDS5000 2.1.0.0R3 where an authenticated attacker can inject OS commands via the "tunnel" parameter when terminating a tunnel connection. Injected commands are executed with root privileges.
- CVE-2025-67035High
An OS command injection vulnerability was found in Lantronix EDS5000 version 2.1.0.0R3 affecting SSH Client and SSH Server pages. Missing input sanitization allows an attacker to inject arbitrary commands when deleting objects like server keys, users, and known hosts. Commands execute with root privileges.
- CVE-2025-67034High
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the 'name' parameter when deleting SSL credentials through the management interface.
Original NVD description (English source)
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS