CVE-2025-70082CWE-288CWE-620CWE-78command-injection

CVE-2025-70082

Low · published March 11, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weaknesses
CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-620 · Unverified Password Change; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-11T21:16Z
Affected products (2)
ProductVersionsFixed in
lantronix/eds3016ps1ns_firmwareall versions—
lantronix/eds3008ps1ns_firmwareall versions—
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 · [email protected]https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw · [email protected]
EPSS history
Timeline
  • 11 MAR 00:00Z
    An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component
    cvelistv5