CVE-2025-67038

9.3 criticalKEVEPSS 20%

Critical (9.3) in Lantronix EDS5000. In CISA KEV since 2026-06-23. EPSS 20% chance of exploitation in the next 30 days.

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2026-06-23, due 2026-06-26
CWE: CWE-78
Published: 2026-03-11
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

Affected

lantronix:e213f102s_firmware
lantronix:e214f002s_firmware
lantronix:e214f00cs_firmware
lantronix:e214g000s_firmware
lantronix:e214g001s_firmware
lantronix:e218f004s_firmware
lantronix:e218g107s_firmware
lantronix:e228g002s_firmware
lantronix:e228g004s_firmware
lantronix:e228g00cb28_firmware
lantronix:e228g00cs_firmware
lantronix:eds5008_firmware
lantronix:eds5016_firmware
lantronix:eds5032_firmware
lantronix:g526gp12s_firmware
lantronix:g526gp17s_firmware
lantronix:g526gp1as_firmware
lantronix:g526gp1asg_firmware
lantronix:g526gp1cs_firmware
lantronix:g527gp22s_firmware
lantronix:g527gp27s_firmware
lantronix:g527gp2as_firmware
lantronix:g527gp2asg_firmware
lantronix:g528gp2fs_firmware
lantronix:g528gp2fsg_firmware
lantronix:g528gp2fsgc_firmware
lantronix:x300f202s_firmware
lantronix:x303f202s_firmware
lantronix:x304g000s_firmware
lantronix:x304g002s_firmware
lantronix:x304g007s_firmware
lantronix:x304g00as_firmware
lantronix:x304g00cs_firmware

References

Check your stack JSON