Lantronix EDS5000 Command Injection Flaws

Unauthenticated root-level OS command injection in Lantronix EDS5000 serial device servers (EDS5032/EDS5008/EDS5016, firmware 2.1.0.0R3) lets remote attackers run arbitrary commands by embedding shell metacharacters in the HTTP RPC login username. When authentication fails, the RPC module builds a shell command to write a log entry and concatenates the attacker-supplied username without sanitization, so the injected payload executes as root. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though the EPSS probability is only 0.02%, indicating targeted rather than mass exploitation.

Authenticated OS command injection in Lantronix EDS5000 firmware 2.1.0.0R3 allows an admin-level attacker to execute arbitrary shell commands as root by injecting metacharacters into the 'name' parameter of the SSL credential deletion workflow in the device's web management interface. CISA ICS advisory ICSA-26-069-02 confirms the flaw across three hardware variants (EDS5008, EDS5016, EDS5032), signaling elevated concern for OT/ICS environments where these serial-to-Ethernet device servers connect legacy industrial equipment. No public exploit code or active exploitation has been identified at time of analysis, and EPSS at 0.02% reflects low current exploitation probability.

OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows an authenticated administrator to execute arbitrary commands as root by injecting shell metacharacters into the "tunnel" parameter during tunnel connection termination. All three hardware variants - EDS5008, EDS5016, and EDS5032 - are confirmed affected per CPE data and CISA ICS Advisory ICSA-26-069-02. No public exploit identified at time of analysis; EPSS at 0.02% (4th percentile) reflects no current automated exploitation activity.

Authenticated OS command injection in Lantronix EDS5000 serial device server firmware 2.1.0.0R3 grants an attacker root-level code execution via unsanitized filename input on the Log Info page. Affecting the EDS5008, EDS5016, and EDS5032 variants, the flaw allows any account with web interface access to inject arbitrary shell commands executed by the underlying OS. CISA issued ICS Advisory ICSA-26-069-02 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.

OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows authenticated administrators to execute arbitrary commands with root privileges through unsanitized parameters in the SSH Client and SSH Server web management pages. Delete operations on SSH objects - server keys, user accounts, and known-host entries - pass attacker-controlled input directly to shell operations without sanitization. CISA has published ICS advisory ICSA-26-069-02 acknowledging the issue; no public exploit code has been identified at time of analysis and the EPSS score remains at 0.02% (4th percentile).