What is the CVSS score of CVE-2025-67035?

CVE-2025-67035 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of SSH are affected by CVE-2025-67035?

Lantronix EDS5000 devices running version 2.1.0.0R3 contain critical OS injection vulnerabilities in SSH configuration pages that allow unauthenticated or low-privileged attackers to execute…

How to fix or mitigate CVE-2025-67035?

Within 24 hours: Inventory all Lantronix EDS5000 devices running 2.1.0.0R3 and restrict network access to SSH Client/Server configuration pages to trusted administrator IPs only. Within 7 days: Implement continuous monitoring for suspicious SSH configuration attempts and verify no unauthorized access has occurred. Within 30 days: Contact Lantronix for patch availability timeline; prepare for emergency firmware upgrade upon release or evaluate replacement with patched alternative devices if timeline is unacceptable.

SSH CVE-2025-67035

CRITICAL

Code Injection (CWE-94)

2026-03-11 cve@mitre.org

SSH

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

Critical vulnerability in Lantronix EDS serial device server (EDS5000/EDS3000PS). Multiple injection and auth bypass vulnerabilities in the management interface.

Technical ContextAI

Multiple vulnerability types in Lantronix EDS management interface.

Affected ProductsAI

Lantronix EDS5000/EDS3000PS

RemediationAI

Apply firmware update. Restrict management access.

CVE-2025-67035 vulnerability details – vuln.today

Back

SSH CVE-2025-67035

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code