Which versions of Lantronix EDS5000 are affected by CVE-2025-67035?

Lantronix EDS5000 device servers (firmware 2.1.0.0R3) contain an authenticated command-injection vulnerability allowing administrators to execute arbitrary commands with root privileges.

How to fix or mitigate CVE-2025-67035?

Within 24 hours: Identify all Lantronix EDS5000 instances running firmware 2.1.0.0R3 and document their role in your infrastructure; audit administrative access logs for unauthorized activity or policy violations. Within 7 days: Contact Lantronix for available firmware versions beyond 2.1.0.0R3; implement network-level access controls restricting SSH management interfaces to a defined set of trusted administrative workstations; enforce strong password requirements and credential rotation for all device administrators. Within 30 days: Test and deploy updated firmware in production once validated; monitor Lantronix security advisories for an official patch to CVE-2025-67035; evaluate network segmentation or device replacement if the EDS5000 provides critical remote-management capabilities.

Lantronix EDS5000 CVE-2025-67035

Q: What is the CVSS score of CVE-2025-67035?

CVE-2025-67035 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Code Injection (CWE-94)

2026-03-11 cve@mitre.org

RCE Code Injection Eds5032 Firmware Eds5008 Firmware Eds5016 Firmware Lantronix

8.6

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Administrative web access is required (PR:H); root command execution provides full CIA impact; no scope change beyond the device itself.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 04, 2026 - 21:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 04, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Sep 04, 2026 - 21:22 NVD

CRITICAL HIGH

CVSS changed

Sep 04, 2026 - 21:22 NVD

9.8 (CRITICAL) 8.6 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows authenticated administrators to execute arbitrary commands with root privileges through unsanitized parameters in the SSH Client and SSH Server web management pages. Delete operations on SSH objects - server keys, user accounts, and known-host entries - pass attacker-controlled input directly to shell operations without sanitization. CISA has published ICS advisory ICSA-26-069-02 acknowledging the issue; no public exploit code has been identified at time of analysis and the EPSS score remains at 0.02% (4th percentile).

Technical ContextAI

The Lantronix EDS5000 is an industrial device server (serial-to-Ethernet gateway) deployed in OT/ICS environments, with the EDS5008 (8-port), EDS5016 (16-port), and EDS5032 (32-port) variants distinguished by port count. The firmware exposes a web management interface including SSH Client and SSH Server configuration pages. CWE-94 is assigned (Code Injection), though the description's 'OS injection' language more precisely aligns with CWE-78 (OS Command Injection) - the web pages construct shell commands incorporating user-supplied parameters from delete actions without sanitization, allowing shell metacharacter injection. Because the underlying firmware process runs as root, any injected command inherits full system privileges. CPE strings confirm the affected firmware as cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0r3, cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0r3, and cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0r3.

RemediationAI

Consult the Lantronix vulnerability library (https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/) and CISA ICS advisory ICSA-26-069-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02) for the official patched firmware - the exact remediated version is not independently confirmed from the available reference data, so firmware upgrade must be verified directly with Lantronix. As immediate compensating controls: restrict administrative web interface access to dedicated management hosts using firewall ACLs, eliminating network-level exposure of the SSH configuration pages (trade-off: reduces operational flexibility for remote management). Enforce strong, unique administrative credentials and audit all accounts with admin access to the device. If SSH key management features are not operationally required, disable or restrict access to the SSH Client and SSH Server management pages entirely. In OT environments, ensure the EDS5000 is on a segmented network zone with no direct Internet exposure.