PT-2025-52602 · Lantronix · Eds5008 Firmware+2

CVE-2025-67035 · Publicado 2025-12-19 · Atualizado 2026-06-23

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lantronix EDS5000 version 2.1.0.0R3

Description The SSH Client and SSH Server pages are susceptible to multiple OS injection flaws because of inadequate input sanitization. An attacker can inject arbitrary commands during delete operations on various objects, including server keys, users, and known hosts. These commands are executed with root privileges. The vulnerable parameters are not explicitly identified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-67035

Produtos afetados

Eds5008 Firmware

Eds5016 Firmware

Eds5032 Firmware

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-67035 · Nota de Segurança
• http://eds5000.com · Nota
• https://cisa.gov/news-events/ics-advisories/icsa-26-069-02 · Nota
• https://twitter.com/CVEnew/status/2033194333189591433 · Publicação no Twitter
• https://t.me/CVEtracker/40274 · Publicação no Telegram
• https://twitter.com/DFIR_Lab/status/2069525204779388937 · Publicação no Twitter
• http://lantronix.com · Nota