by Kastro
Paper/Archive/CVE-2025-67038

CVE-2025-67038

Lantronix EDS5000 series — Lantronix EDS5000, G520, and X300 OS Command Injection

KEV · due 26 JunEPSS 20%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 97.5.975 × 2019.5Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Affected

ProductAffectedFixed inSource
EDS5000 series≤ 2.1.0.0R32.2.0.0R1CNA
G520 series< 2.6.0.4R62.6.0.4R6CNA
X300 series< 2.6.0.4R62.6.0.4R6CNA
E210 series< 3.21.0.0R13.21.0.0R1CNA
E220 series< 3.21.0.0R13.21.0.0R1CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reflantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgwrefcisa.gov/news-events/ics-advisories/icsa-26-069-02refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.jsonrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038kevcisa.gov/known-exploited-vulnerabilities-catalog