PT-2025-52604 · Lantronix · Eds5008 Firmware+2

Published 2025-12-19 · Updated 2026-03-15 · CVE-2025-67037

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lantronix EDS5000 version 2.1.0.0R3

Description An authenticated attacker can inject operating system commands into the tunnel parameter when terminating a tunnel connection. These injected commands are executed with root privileges. The affected product is Lantronix EDS5000.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the tunnel parameter.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-67037

Affected Products

Eds5008 Firmware

Eds5016 Firmware

Eds5032 Firmware

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-67037 · Security Note
• https://t.me/CVEtracker/40276 · Telegram Post
• http://lantronix.com · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-069-02 · Note
• https://twitter.com/CVEnew/status/2033194334988996857 · Twitter Post
• http://eds5000.com · Note