IM
IronMonkey Threat Research

CVE-2025-67037 HIGH

Published: 2026-03-11 | Last Modified: 2026-09-04 | Status: Modified

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.

Additional Descriptions (1)

Se descubrió una vulnerabilidad en Lantronix EDS5000 2.1.0.0R3. Un atacante autenticado puede inyectar comandos del sistema operativo en el parámetro 'tunnel' al finalizar una conexión de túnel. Los comandos inyectados se ejecutan con privilegios de root.

CVSS Metrics

Base Score: 7.2 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Secondary

Exploitability Score: 1.2

Impact Score: 5.9

Base Score: 8.6 (HIGH)

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack VectorNETWORK
Attack ComplexityLOW
Attack RequirementsNONE
Privileges RequiredHIGH
User InteractionNONE
Vulnerability ConfidentialityHIGH
Vulnerability IntegrityHIGH
Vulnerability AvailabilityHIGH
Subsequent ConfidentialityNONE
Subsequent IntegrityNONE
Subsequent AvailabilityNONE

Source: [email protected]

Type: Secondary

Weaknesses

Source Type Description
[email protected] Primary
en CWE-78
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-94

Affected Products

Vendor Product Version Update Type
lantronix eds5032_firmware 2.1.0.0 <built-in method update of dict object at 0x7fd2dbf6ec80> Operating System
lantronix eds5008_firmware 2.1.0.0 <built-in method update of dict object at 0x7fd2a2793840> Operating System
lantronix eds5016_firmware 2.1.0.0 <built-in method update of dict object at 0x7fd2a27929c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds5032:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds5008:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds5016:-:*:*:*:*:*:*:*

References