Which versions of Lantronix EDS5000 are affected by CVE-2025-67037?

Lantronix EDS5000 series device servers (EDS5008, EDS5016, EDS5032) running firmware 2.1.0.0R3 contain an OS command injection vulnerability allowing authenticated administrators to execute arbitrary…

How to fix or mitigate CVE-2025-67037?

Within 24 hours: complete an inventory of all EDS5000 devices (all three hardware variants), document firmware versions, revoke or rotate all default and shared administrative credentials, and restrict console access to a minimal set of vetted administrators only. Within 7 days: implement network segmentation isolating device servers behind dedicated firewalls, disable unnecessary remote-management protocols, configure firewall rules limiting administrative access to specific approved source IPs, and enable comprehensive audit logging of all administrator actions. Within 30 days: monitor CISA advisory ICSA-26-069-02 for vendor firmware patches, evaluate whether firmware versions beyond 2.1.0.0R3 offer fixes, develop a staged upgrade plan if patches become available, and consider disabling tunnel functionality entirely if not operationally critical.

Lantronix EDS5000 CVE-2025-67037

Q: What is the CVSS score of CVE-2025-67037?

CVE-2025-67037 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Code Injection (CWE-94)

2026-03-11 cve@mitre.org

RCE Code Injection Eds5032 Firmware Eds5008 Firmware Eds5016 Firmware Lantronix

8.6

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Authenticated admin (PR:H) exploits network-reachable web interface; S:C because injection crosses from web process into root OS execution context.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 04, 2026 - 21:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 04, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Sep 04, 2026 - 21:22 NVD

8.8 (HIGH) 8.6 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows an authenticated administrator to execute arbitrary commands as root by injecting shell metacharacters into the "tunnel" parameter during tunnel connection termination. All three hardware variants - EDS5008, EDS5016, and EDS5032 - are confirmed affected per CPE data and CISA ICS Advisory ICSA-26-069-02. No public exploit identified at time of analysis; EPSS at 0.02% (4th percentile) reflects no current automated exploitation activity.

Technical ContextAI

Lantronix EDS5000 is a serial-to-Ethernet device server used in industrial and OT environments to bridge legacy serial equipment onto IP networks. The firmware exposes a web management interface through which administrators manage tunnel connections between serial ports and TCP/IP endpoints. The vulnerability lies in the tunnel kill/termination function, which passes the "tunnel" parameter value unsanitized to an underlying OS command invocation, enabling classic OS command injection (CWE-94: Improper Control of Generation of Code). Because the web management process runs as or escalates to root, injected payloads execute with full OS privileges. Affected CPE strings are cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3, cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3, and cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3, covering the 8-port, 16-port, and 32-port variants respectively.

RemediationAI

Consult the Lantronix vulnerability library at https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/ and CISA ICS Advisory ICSA-26-069-02 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 for vendor-released firmware updates; a specific patched firmware version number is not independently confirmed from available reference data and must be obtained directly from Lantronix. As immediate compensating controls: restrict management interface access to dedicated, isolated OT management VLANs using firewall ACLs, blocking any broader network or internet access to the device's management port; enforce strong, unique administrative passwords to eliminate default-credential exploitation chains; and audit all accounts with management-level access to minimize the population of credentials that could be leveraged. Note that restricting management interface access does not affect device tunneling functionality in typical OT deployments.