CVE-2025-67034
published 2026-03-11CVE-2025-67034: An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.49%
38.4th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lantronix | eds5008_firmware | — | — |
| lantronix | eds5016_firmware | — | — |
| lantronix | eds5032_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Lantronix EDS3000PS and EDS5000
cisa_ics·2026-03-10·CVSS 8.8
[HIGH] Lantronix EDS3000PS and EDS5000
ICS Advisory
##
Lantronix EDS3000PS and EDS5000
Release DateMarch 10, 2026
Alert CodeICSA-26-069-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges.
The following versions of Lantronix EDS3000PS and EDS5000 are affected:
- EDS3000PS 3.1.0.0R2 (CVE-2025-67039, CVE-2025-70082, CVE-2025-67041)
- EDS5000 2.1.0.0R3 (CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.8
| Lantronix
| Lantronix EDS3000PS and EDS5000
| Improper Neutralization of Special Elements used in an OS Command ('OS Comm
GHSA
GHSA-fx2j-qf8p-f9ph: An issue was discovered in Lantronix EDS5000 2
ghsa_unreviewed·2026-03-11
CVE-2025-67034 [HIGH] CWE-94 GHSA-fx2j-qf8p-f9ph: An issue was discovered in Lantronix EDS5000 2
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.
No detection rules found.
No public exploits indexed.
2026-03-11
Published