by Kastro
Paper/Archive/CVE-2025-70082

CVE-2025-70082

Lantronix EDS3000PS series — Lantronix EDS3000PS Unverified Password Change

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.0.420 × 208.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.

Affected

ProductAffectedFixed inSource
EDS3000PS series≤ 3.1.0.0R23.2.0.0R2CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
icscert (CNA)2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reflantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgwrefcisa.gov/news-events/ics-advisories/icsa-26-069-02refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json