Lantronix
Monthly
Unauthenticated root-level OS command injection in Lantronix EDS5000 serial device servers (EDS5032/EDS5008/EDS5016, firmware 2.1.0.0R3) lets remote attackers run arbitrary commands by embedding shell metacharacters in the HTTP RPC login username. When authentication fails, the RPC module builds a shell command to write a log entry and concatenates the attacker-supplied username without sanitization, so the injected payload executes as root. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though the EPSS probability is only 0.02%, indicating targeted rather than mass exploitation.
Critical vulnerability in Lantronix EDS serial device server (EDS5000/EDS3000PS). Multiple injection and auth bypass vulnerabilities in the management interface.
Authenticated OS command injection in the Lantronix EDS3000PS serial device server firmware 3.1.0.0R2 allows a high-privileged attacker to execute arbitrary commands with root OS privileges via the unsanitized host parameter of the TFTP client in the Filesystem Browser page. Affected hardware variants are confirmed as the EDS3016PS1NS and EDS3008PS1NS models per CPE data. CISA issued ICS advisory ICSA-26-069-02 covering this vulnerability, indicating industrial/OT significance. No public exploit code or KEV listing is present; EPSS is 0.04% (13th percentile), reflecting low general exploitation probability but elevated concern in OT contexts where device admin credentials may be shared or weakly controlled.
Authentication bypass in Lantronix EDS3000PS device servers (firmware 3.1.0.0R2, EDS3016PS1NS and EDS3008PS1NS variants) lets a remote unauthenticated attacker reach protected management pages by appending a specific suffix to the request URL and supplying an Authorization header that uses 'admin' as the username. Successful bypass yields full administrative control of the serial-to-Ethernet device server without valid credentials. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3.
OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows an authenticated administrator to execute arbitrary commands as root by injecting shell metacharacters into the "tunnel" parameter during tunnel connection termination. All three hardware variants - EDS5008, EDS5016, and EDS5032 - are confirmed affected per CPE data and CISA ICS Advisory ICSA-26-069-02. No public exploit identified at time of analysis; EPSS at 0.02% (4th percentile) reflects no current automated exploitation activity.
Authenticated OS command injection in Lantronix EDS5000 serial device server firmware 2.1.0.0R3 grants an attacker root-level code execution via unsanitized filename input on the Log Info page. Affecting the EDS5008, EDS5016, and EDS5032 variants, the flaw allows any account with web interface access to inject arbitrary shell commands executed by the underlying OS. CISA issued ICS Advisory ICSA-26-069-02 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows authenticated administrators to execute arbitrary commands with root privileges through unsanitized parameters in the SSH Client and SSH Server web management pages. Delete operations on SSH objects - server keys, user accounts, and known-host entries - pass attacker-controlled input directly to shell operations without sanitization. CISA has published ICS advisory ICSA-26-069-02 acknowledging the issue; no public exploit code has been identified at time of analysis and the EPSS score remains at 0.02% (4th percentile).
Authenticated OS command injection in Lantronix EDS5000 firmware 2.1.0.0R3 allows an admin-level attacker to execute arbitrary shell commands as root by injecting metacharacters into the 'name' parameter of the SSL credential deletion workflow in the device's web management interface. CISA ICS advisory ICSA-26-069-02 confirms the flaw across three hardware variants (EDS5008, EDS5016, EDS5032), signaling elevated concern for OT/ICS environments where these serial-to-Ethernet device servers connect legacy industrial equipment. No public exploit code or active exploitation has been identified at time of analysis, and EPSS at 0.02% reflects low current exploitation probability.
A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FSBrowsePage functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Baseon Lantronix MSS devices do not require a password for TELNET access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Lantronix xPrintServer devices with firmware before 5.0.1-65 have hardcoded credentials, which allows remote attackers to obtain root access via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated root-level OS command injection in Lantronix EDS5000 serial device servers (EDS5032/EDS5008/EDS5016, firmware 2.1.0.0R3) lets remote attackers run arbitrary commands by embedding shell metacharacters in the HTTP RPC login username. When authentication fails, the RPC module builds a shell command to write a log entry and concatenates the attacker-supplied username without sanitization, so the injected payload executes as root. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though the EPSS probability is only 0.02%, indicating targeted rather than mass exploitation.
Critical vulnerability in Lantronix EDS serial device server (EDS5000/EDS3000PS). Multiple injection and auth bypass vulnerabilities in the management interface.
Authenticated OS command injection in the Lantronix EDS3000PS serial device server firmware 3.1.0.0R2 allows a high-privileged attacker to execute arbitrary commands with root OS privileges via the unsanitized host parameter of the TFTP client in the Filesystem Browser page. Affected hardware variants are confirmed as the EDS3016PS1NS and EDS3008PS1NS models per CPE data. CISA issued ICS advisory ICSA-26-069-02 covering this vulnerability, indicating industrial/OT significance. No public exploit code or KEV listing is present; EPSS is 0.04% (13th percentile), reflecting low general exploitation probability but elevated concern in OT contexts where device admin credentials may be shared or weakly controlled.
Authentication bypass in Lantronix EDS3000PS device servers (firmware 3.1.0.0R2, EDS3016PS1NS and EDS3008PS1NS variants) lets a remote unauthenticated attacker reach protected management pages by appending a specific suffix to the request URL and supplying an Authorization header that uses 'admin' as the username. Successful bypass yields full administrative control of the serial-to-Ethernet device server without valid credentials. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially exploitable and carries a CVSS 4.0 base score of 9.3.
OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows an authenticated administrator to execute arbitrary commands as root by injecting shell metacharacters into the "tunnel" parameter during tunnel connection termination. All three hardware variants - EDS5008, EDS5016, and EDS5032 - are confirmed affected per CPE data and CISA ICS Advisory ICSA-26-069-02. No public exploit identified at time of analysis; EPSS at 0.02% (4th percentile) reflects no current automated exploitation activity.
Authenticated OS command injection in Lantronix EDS5000 serial device server firmware 2.1.0.0R3 grants an attacker root-level code execution via unsanitized filename input on the Log Info page. Affecting the EDS5008, EDS5016, and EDS5032 variants, the flaw allows any account with web interface access to inject arbitrary shell commands executed by the underlying OS. CISA issued ICS Advisory ICSA-26-069-02 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in Lantronix EDS5000 series device server firmware 2.1.0.0R3 allows authenticated administrators to execute arbitrary commands with root privileges through unsanitized parameters in the SSH Client and SSH Server web management pages. Delete operations on SSH objects - server keys, user accounts, and known-host entries - pass attacker-controlled input directly to shell operations without sanitization. CISA has published ICS advisory ICSA-26-069-02 acknowledging the issue; no public exploit code has been identified at time of analysis and the EPSS score remains at 0.02% (4th percentile).
Authenticated OS command injection in Lantronix EDS5000 firmware 2.1.0.0R3 allows an admin-level attacker to execute arbitrary shell commands as root by injecting metacharacters into the 'name' parameter of the SSL credential deletion workflow in the device's web management interface. CISA ICS advisory ICSA-26-069-02 confirms the flaw across three hardware variants (EDS5008, EDS5016, EDS5032), signaling elevated concern for OT/ICS environments where these serial-to-Ethernet device servers connect legacy industrial equipment. No public exploit code or active exploitation has been identified at time of analysis, and EPSS at 0.02% reflects low current exploitation probability.
A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FSBrowsePage functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Baseon Lantronix MSS devices do not require a password for TELNET access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Lantronix xPrintServer devices with firmware before 5.0.1-65 have hardcoded credentials, which allows remote attackers to obtain root access via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.