Which versions of Lantronix EDS3000PS are affected by CVE-2025-67039?

Lantronix EDS3000PS device servers (firmware 3.1.0.0R2) in models EDS3016PS1NS and EDS3008PS1NS contain a critical authentication bypass enabling unauthenticated remote administrative access through…

How to fix or mitigate CVE-2025-67039?

Within 24 hours, audit your environment to identify all deployed Lantronix EDS3000PS, EDS3016PS1NS, and EDS3008PS1NS device servers running firmware 3.1.0.0R2 and immediately restrict network access to their management interfaces using firewall rules or network segmentation to permit only trusted administrative workstations. Within 7 days, contact Lantronix for available firmware updates or interim mitigations, enable comprehensive access logging on affected devices, and assess alternative device server solutions not affected by this flaw. Within 30 days, execute a detailed remediation plan including either migrating to patched firmware when available or transitioning affected infrastructure to replacement hardware, and establish continuous monitoring for unauthorized administrative access attempts.

Lantronix EDS3000PS CVE-2025-67039

Q: What is the CVSS score of CVE-2025-67039?

CVE-2025-67039 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-11 cve@mitre.org

Authentication Bypass Eds3016Ps1Ns Firmware Eds3008Ps1Ns Firmware Lantronix

9.3

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, low-complexity, fully unauthenticated bypass (AV:N/AC:L/PR:N/UI:N) granting admin control, so high C/I/A; impact stays within the device, so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 04, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 04, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Sep 04, 2026 - 21:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 9.1

DescriptionCVE.org

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

Authentication bypass in Lantronix EDS3000PS device servers (firmware 3.1.0.0R2, EDS3016PS1NS and EDS3008PS1NS variants) lets a remote unauthenticated attacker reach protected management pages by appending a specific suffix to the request URL and supplying an Authorization header that uses 'admin' as the username. Successful bypass yields full administrative control of the serial-to-Ethernet device server without valid credentials. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3.

Technical ContextAI

The Lantronix EDS3000PS family are serial-to-Ethernet device servers used to network-enable RS-232/422/485 equipment, commonly in OT/ICS, industrial, and building-automation environments. The vulnerability is CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the device's web management interface enforces access control on canonical management page URLs, but that enforcement can be defeated by requesting an alternate URL form (a specific appended suffix) combined with an Authorization header naming the built-in 'admin' account. The server treats the alternate path/header combination as trusted, exposing privileged pages that should require authentication. The affected firmware is identified in CPE as cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0r2 and cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0r2.

RemediationAI

Consult the CISA ICS advisory (icsa-26-069-02) and the Lantronix vulnerability library for the vendor's fixed firmware; no exact fixed version number is stated in the provided data, so treat patch status as 'Patch available per vendor advisory' and apply the vendor-recommended firmware update for the EDS3016PS1NS/EDS3008PS1NS once confirmed. Because these are OT device servers, until patched apply network-level compensating controls: remove the management interface from any internet exposure and place devices on an isolated management VLAN; restrict access to the web management port to a small set of trusted administrative hosts via firewall/ACL (trade-off: legitimate remote admin must go through a jump host/VPN); and monitor for anomalous requests to management URLs containing unexpected suffixes or 'admin' Authorization headers. Disabling or firewalling the HTTP management service where feasible eliminates the attack surface at the cost of losing remote web administration.