CVE-2025-70082
published 2026-03-11CVE-2025-70082: An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.50%
38.8th percentile
An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lantronix | eds3008ps1ns_firmware | — | — |
| lantronix | eds3016ps1ns_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Lantronix EDS3000PS and EDS5000
cisa_ics·2026-03-10·CVSS 8.8
[HIGH] Lantronix EDS3000PS and EDS5000
ICS Advisory
##
Lantronix EDS3000PS and EDS5000
Release DateMarch 10, 2026
Alert CodeICSA-26-069-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges.
The following versions of Lantronix EDS3000PS and EDS5000 are affected:
- EDS3000PS 3.1.0.0R2 (CVE-2025-67039, CVE-2025-70082, CVE-2025-67041)
- EDS5000 2.1.0.0R3 (CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 9.8
| Lantronix
| Lantronix EDS3000PS and EDS5000
| Improper Neutralization of Special Elements used in an OS Command ('OS Comm
GHSA
GHSA-pc68-63w9-jjcc: An issue in Lantronix EDS3000PS v
ghsa_unreviewed·2026-03-11
CVE-2025-70082 [CRITICAL] CWE-78 GHSA-pc68-63w9-jjcc: An issue in Lantronix EDS3000PS v
An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component
No detection rules found.
No public exploits indexed.
2026-03-11
Published