Which versions of Lantronix EDS5000 are affected by CVE-2025-67034?

Lantronix EDS5000 series industrial device servers (EDS5008, EDS5016, EDS5032) in firmware 2.1.0.0R3 are vulnerable to authenticated command injection allowing root-level code execution.

How to fix or mitigate CVE-2025-67034?

Within 24 hours, inventory all Lantronix EDS5000 variants in your environment and identify devices running firmware 2.1.0.0R3. Within 7 days, implement network segmentation to restrict administrative access to a dedicated management subnet, enforce multi-factor authentication on all admin accounts, and establish enhanced logging of administrative operations on these devices. Within 30 days, contact Lantronix support directly to determine patch availability and timeline, evaluate available firmware upgrades or product alternatives if no patch emerges, and audit all active administrative accounts with credentials on these systems to reduce standing privileges.

Lantronix EDS5000 CVE-2025-67034

Q: What is the CVSS score of CVE-2025-67034?

CVE-2025-67034 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Code Injection (CWE-94)

2026-03-11 cve@mitre.org

RCE Code Injection Eds5032 Firmware Eds5008 Firmware Eds5016 Firmware Lantronix

8.6

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Admin authentication required (PR:H) and network-delivered (AV:N); root command execution grants full confidentiality, integrity, and availability impact on the device with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 04, 2026 - 20:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 04, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Sep 04, 2026 - 20:22 NVD

8.8 (HIGH) 8.6 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

Authenticated OS command injection in Lantronix EDS5000 firmware 2.1.0.0R3 allows an admin-level attacker to execute arbitrary shell commands as root by injecting metacharacters into the 'name' parameter of the SSL credential deletion workflow in the device's web management interface. CISA ICS advisory ICSA-26-069-02 confirms the flaw across three hardware variants (EDS5008, EDS5016, EDS5032), signaling elevated concern for OT/ICS environments where these serial-to-Ethernet device servers connect legacy industrial equipment. No public exploit code or active exploitation has been identified at time of analysis, and EPSS at 0.02% reflects low current exploitation probability.

Technical ContextAI

The Lantronix EDS5000 series are serial-to-Ethernet device servers deployed in industrial and OT environments, running embedded Linux firmware. The affected firmware version 2.1.0.0R3 applies to the EDS5008 (8-port), EDS5016 (16-port), and EDS5032 (32-port) variants, confirmed by CPE strings cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0r3, cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0r3, and cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0r3. The root cause is CWE-94 (Improper Control of Generation of Code), manifesting as classic OS command injection: the 'name' parameter supplied during SSL credential deletion is passed unsanitized to a shell invocation, allowing shell metacharacters (semicolons, pipes, backticks) to break out of the intended command context and inject arbitrary OS commands. Because the management process runs as root, injected commands inherit full root privileges on the embedded system.

RemediationAI

Consult the Lantronix security vulnerability library at https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/ for patched firmware - no specific fix version is confirmed in the available reference data, and the exact remediation version must be obtained directly from Lantronix. Per CISA advisory ICSA-26-069-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02), asset owners should apply vendor-released firmware updates as the primary fix. Until patched, restrict management interface access to a dedicated, firewalled management VLAN accessible only from trusted administrator workstations; disabling remote management entirely is the strongest compensating control if operationally feasible. Enforce strong, unique credentials for all management accounts and rotate any credentials that may have been shared or exposed. Avoid exposing the management interface to the internet or untrusted OT segments.