CVE-2025-67034CWE-78CWE-94command-injectioncode-injection

CVE-2025-67034

High · published March 11, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00515 · 43.0th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-03-11T21:16Z
Affected products (3)
ProductVersionsFixed in
lantronix/eds5032_firmwareall versions—
lantronix/eds5008_firmwareall versions—
lantronix/eds5016_firmwareall versions—
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 · [email protected]https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw · [email protected]
EPSS history
Timeline
  • 11 MAR 00:00Z
    An issue was discovered in Lantronix EDS5000 2.1.0.0R3
    cvelistv5