Which versions of Lantronix EDS3000PS are affected by CVE-2025-67041?

Lantronix serial device servers deployed in industrial settings (EDS3016PS1NS and EDS3008PS1NS models) contain a command injection vulnerability that allows privileged users to execute arbitrary…

How to fix or mitigate CVE-2025-67041?

Within 24 hours, audit administrative credentials and access logs for all Lantronix EDS3000PS devices running firmware 3.1.0.0R2, immediately restricting admin accounts to named personnel with strong authentication. Within 7 days, implement network segmentation to isolate device management access and disable TFTP client functionality if operationally feasible to reduce attack surface. Within 30 days, deploy continuous monitoring and alerting for administrative commands, establish credential rotation policies for any shared admin accounts, and escalate to procurement to develop hardware replacement or extended mitigation strategy pending vendor patch availability.

Lantronix EDS3000PS CVE-2025-67041

Q: What is the CVSS score of CVE-2025-67041?

CVE-2025-67041 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

OS Command Injection (CWE-78)

2026-03-11 cve@mitre.org

Command Injection Eds3016Ps1Ns Firmware Eds3008Ps1Ns Firmware Lantronix

8.6

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-accessible web UI, admin auth required (PR:H), scope changes from web app context to OS root (S:C), full CIA impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 04, 2026 - 21:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 04, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Sep 04, 2026 - 21:22 NVD

CRITICAL HIGH

CVSS changed

Sep 04, 2026 - 21:22 NVD

9.8 (CRITICAL) 8.6 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

Authenticated OS command injection in the Lantronix EDS3000PS serial device server firmware 3.1.0.0R2 allows a high-privileged attacker to execute arbitrary commands with root OS privileges via the unsanitized host parameter of the TFTP client in the Filesystem Browser page. Affected hardware variants are confirmed as the EDS3016PS1NS and EDS3008PS1NS models per CPE data. CISA issued ICS advisory ICSA-26-069-02 covering this vulnerability, indicating industrial/OT significance. No public exploit code or KEV listing is present; EPSS is 0.04% (13th percentile), reflecting low general exploitation probability but elevated concern in OT contexts where device admin credentials may be shared or weakly controlled.

Technical ContextAI

The Lantronix EDS3000PS product line is an industrial serial-to-network device server used in OT/ICS environments to connect legacy serial equipment over TCP/IP. Affected firmware versions per CPE are cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0r2 and cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0r2. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Specifically, the web-based Filesystem Browser exposes a TFTP client whose host field is passed to a shell command without adequate sanitization, permitting command separator injection (e.g., semicolons, backticks, or pipes). Because the underlying TFTP operation runs with root privileges, injected commands inherit that privilege level, achieving full OS compromise from a web interface action.

RemediationAI

Consult the Lantronix vulnerability library at https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/ and the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 for the vendor-released firmware update; no specific fixed version number is present in the available data, so a patched release version cannot be independently confirmed from this dataset. Until a patch is applied, restrict access to the device web management interface to dedicated management VLANs or jump hosts using firewall rules, eliminating network-layer reachability from untrusted segments. Rotate and enforce strong, unique administrative credentials to reduce the likelihood of credential-based pre-exploitation. Disable TFTP client functionality in the Filesystem Browser if it is not operationally required - consult the Lantronix admin guide for the relevant setting - which removes the vulnerable code path entirely with no impact on core serial-to-network functionality. Monitor device management logs for unexpected TFTP client invocations as a detection control.