Eds3016Ps1Ns Firmware
Monthly
Critical vulnerability in Lantronix EDS serial device server (EDS5000/EDS3000PS). Multiple injection and auth bypass vulnerabilities in the management interface.
Authenticated OS command injection in the Lantronix EDS3000PS serial device server firmware 3.1.0.0R2 allows a high-privileged attacker to execute arbitrary commands with root OS privileges via the unsanitized host parameter of the TFTP client in the Filesystem Browser page. Affected hardware variants are confirmed as the EDS3016PS1NS and EDS3008PS1NS models per CPE data. CISA issued ICS advisory ICSA-26-069-02 covering this vulnerability, indicating industrial/OT significance. No public exploit code or KEV listing is present; EPSS is 0.04% (13th percentile), reflecting low general exploitation probability but elevated concern in OT contexts where device admin credentials may be shared or weakly controlled.
Authentication bypass in Lantronix EDS3000PS device servers (firmware 3.1.0.0R2, EDS3016PS1NS and EDS3008PS1NS variants) lets a remote unauthenticated attacker reach protected management pages by appending a specific suffix to the request URL and supplying an Authorization header that uses 'admin' as the username. Successful bypass yields full administrative control of the serial-to-Ethernet device server without valid credentials. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3.
Critical vulnerability in Lantronix EDS serial device server (EDS5000/EDS3000PS). Multiple injection and auth bypass vulnerabilities in the management interface.
Authenticated OS command injection in the Lantronix EDS3000PS serial device server firmware 3.1.0.0R2 allows a high-privileged attacker to execute arbitrary commands with root OS privileges via the unsanitized host parameter of the TFTP client in the Filesystem Browser page. Affected hardware variants are confirmed as the EDS3016PS1NS and EDS3008PS1NS models per CPE data. CISA issued ICS advisory ICSA-26-069-02 covering this vulnerability, indicating industrial/OT significance. No public exploit code or KEV listing is present; EPSS is 0.04% (13th percentile), reflecting low general exploitation probability but elevated concern in OT contexts where device admin credentials may be shared or weakly controlled.
Authentication bypass in Lantronix EDS3000PS device servers (firmware 3.1.0.0R2, EDS3016PS1NS and EDS3008PS1NS variants) lets a remote unauthenticated attacker reach protected management pages by appending a specific suffix to the request URL and supplying an Authorization header that uses 'admin' as the username. Successful bypass yields full administrative control of the serial-to-Ethernet device server without valid credentials. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3.