What is the CVSS score of CVE-2025-67035?

CVE-2025-67035 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Eds5032 Firmware are affected by CVE-2025-67035?

Lantronix EDS5000 devices running version 2.1.0.0R3 contain critical OS injection vulnerabilities in SSH configuration pages that allow unauthenticated or low-privileged attackers to execute…

How to fix or mitigate CVE-2025-67035?

Within 24 hours: Inventory all Lantronix EDS5000 devices running 2.1.0.0R3 and restrict network access to SSH Client/Server configuration pages to trusted administrator IPs only. Within 7 days: Implement continuous monitoring for suspicious SSH configuration attempts and verify no unauthorized access has occurred. Within 30 days: Contact Lantronix for patch availability timeline; prepare for emergency firmware upgrade upon release or evaluate replacement with patched alternative devices if timeline is unacceptable.

Eds5032 Firmware CVE-2025-67035

CRITICAL

Code Injection (CWE-94)

2026-03-11 cve@mitre.org

Code Injection RCE Eds5032 Firmware Eds5008 Firmware Eds5016 Firmware

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

Critical vulnerability in Lantronix EDS serial device server (EDS5000/EDS3000PS). Multiple injection and auth bypass vulnerabilities in the management interface.