CVE-2025-67041CWE-288CWE-620CWE-78command-injection

CVE-2025-67041

High · published March 11, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.6th percentile
Weaknesses
CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-620 · Unverified Password Change; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-11T21:16Z
Affected products (2)
ProductVersionsFixed in
lantronix/eds3016ps1ns_firmwareall versions—
lantronix/eds3008ps1ns_firmwareall versions—
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 · [email protected]https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw · [email protected]
EPSS history
Timeline
  • 11 MAR 00:00Z
    An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2
    cvelistv5