CVE-2025-67036
published 2026-03-11CVE-2025-67036: An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.38%
30.2th percentile
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lantronix | eds5008_firmware | — | — |
| lantronix | eds5016_firmware | — | — |
| lantronix | eds5032_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Lantronix EDS3000PS and EDS5000
cisa_ics·2026-03-10·CVSS 8.8
[HIGH] Lantronix EDS3000PS and EDS5000
ICS Advisory
##
Lantronix EDS3000PS and EDS5000
Release DateMarch 10, 2026
Alert CodeICSA-26-069-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges.
The following versions of Lantronix EDS3000PS and EDS5000 are affected:
- EDS3000PS 3.1.0.0R2 (CVE-2025-67039, CVE-2025-70082, CVE-2025-67041)
- EDS5000 2.1.0.0R3 (CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.8
| Lantronix
| Lantronix EDS3000PS and EDS5000
| Improper Neutralization of Special Elements used in an OS Command ('OS Comm
GHSA
GHSA-j94v-49mv-xq4h: An issue was discovered in Lantronix EDS5000 2
ghsa_unreviewed·2026-03-11
CVE-2025-67036 [HIGH] CWE-94 GHSA-j94v-49mv-xq4h: An issue was discovered in Lantronix EDS5000 2
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
No detection rules found.
No public exploits indexed.
2026-03-11
Published