Lantronix EDS5000
CVE-2025-67036
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web UI, no special conditions, but requires high-privilege authentication; full root impact on the device itself with no scope change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
Articles & Coverage 1
AnalysisAI
Authenticated OS command injection in Lantronix EDS5000 serial device server firmware 2.1.0.0R3 grants an attacker root-level code execution via unsanitized filename input on the Log Info page. Affecting the EDS5008, EDS5016, and EDS5032 variants, the flaw allows any account with web interface access to inject arbitrary shell commands executed by the underlying OS. CISA issued ICS Advisory ICSA-26-069-02 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The Lantronix EDS5000 family (EDS5008, EDS5016, EDS5032) are serial-to-Ethernet device servers widely used in OT/industrial environments to bridge legacy serial equipment to IP networks. The affected firmware version is 2.1.0.0R3, as identified in CPE strings cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0r3, cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0r3, and cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0r3. The Log Info page, a web UI feature that retrieves log files by name, passes the user-supplied filename parameter directly to an OS-level operation without sanitization. CWE-94 (Improper Control of Code Generation) is assigned, though CWE-78 (OS Command Injection) would be more precisely descriptive of the root cause: shell metacharacters in the filename are interpreted by the underlying shell, executing arbitrary commands as root. This reflects a server-side injection flaw in the device's embedded web application.
RemediationAI
Apply the firmware update recommended in the Lantronix vulnerability library (https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/) and the CISA ICS advisory ICSA-26-069-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 and the CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json). The exact patched firmware version is not independently confirmed from the available reference data - consult the Lantronix advisory directly for the target version. As interim mitigations, restrict web interface access to trusted administrator accounts only, enforce strong unique credentials on all EDS5000 management interfaces, and place the management network behind a firewall or VPN to block untrusted network access to the web UI port. Disabling the Log Info page feature entirely, if supported by the firmware, would eliminate the vulnerable code path but may impair operational diagnostics.
More in Eds5032 Firmware
View allUnauthenticated root-level OS command injection in Lantronix EDS5000 serial device servers (EDS5032/EDS5008/EDS5016, fir
OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows an authenticated administrator
OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows authenticated administrators to
Authenticated OS command injection in Lantronix EDS5000 firmware 2.1.0.0R3 allows an admin-level attacker to execute arb
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today