CVE-2025-67036CWE-78CWE-94command-injectioncode-injection

CVE-2025-67036

High · published March 11, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.6th percentile
Weaknesses
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-03-11T21:16Z
Affected products (3)
ProductVersionsFixed in
lantronix/eds5032_firmwareall versions—
lantronix/eds5008_firmwareall versions—
lantronix/eds5016_firmwareall versions—
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 · [email protected]https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw · [email protected]
EPSS history
Timeline
  • 11 MAR 00:00Z
    An issue was discovered in Lantronix EDS5000 2.1.0.0R3
    cvelistv5