cve.bz

CVE-2025-67034

8.6 highEPSS 0.5%

High (8.6) in lantronix. EPSS 0.5% chance of exploitation in the next 30 days.

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

Severity

CVSS 4.0

8.6 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.2 high
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWEs
CWE-78, CWE-94
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON