What is the CVSS score of CVE-2025-67034?

CVE-2025-67034 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Eds5032 Firmware are affected by CVE-2025-67034?

Lantronix EDS5000 devices (version 2.1.0.0R3) contain a critical command injection vulnerability in the SSL credential management interface that allows authenticated attackers to execute arbitrary…

How to fix or mitigate CVE-2025-67034?

Within 24 hours: Identify all Lantronix EDS5000 devices running version 2.1.0.0R3 in your environment and document their criticality and network location. Within 7 days: Restrict management interface access to a minimal set of trusted administrators using network segmentation, strong MFA, and access logging; disable SSL credential management features if operationally feasible. Within 30 days: Contact Lantronix for patch availability and timeline; evaluate alternative device solutions or implement air-gapped management networks as interim mitigations.

Eds5032 Firmware CVE-2025-67034

HIGH

Code Injection (CWE-94)

2026-03-11 cve@mitre.org

Code Injection RCE Eds5032 Firmware Eds5008 Firmware Eds5016 Firmware

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

Technical ContextAI

Classified as CWE-94 (Code Injection). An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.