PT-2026-24722 · Lantronix · Eds5008 Firmware+2

CVE-2025-67034 · Publicado 2026-03-11 · Atualizado 2026-06-23

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lantronix EDS5000 version 2.1.0.0R3

Description An authenticated attacker can inject operating system commands into the name parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges. The affected API endpoint is the SSL credential deletion function within the management interface.

Recommendations Versions prior to 2.1.0.0R3 are potentially vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-67034

Produtos afetados

Eds5008 Firmware

Eds5016 Firmware

Eds5032 Firmware

Referências · 6

• http://eds5000.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-67034 · Nota de Segurança
• https://twitter.com/CVEnew/status/2033194332308771187 · Publicação no Twitter
• http://lantronix.com · Nota
• https://twitter.com/DFIR_Lab/status/2069520170154897901 · Publicação no Twitter
• https://cisa.gov/news-events/ics-advisories/icsa-26-069-02 · Nota