CVE-2025-67038 CRITICAL

Published: 2026-03-11 | Last Modified: 2026-07-06 | Status: Analyzed

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Additional Descriptions (1)

Se descubrió un problema en Lantronix EDS5000 2.1.0.0R3. El módulo HTTP RPC ejecuta un comando de shell para escribir registros cuando la autenticación del usuario falla. El nombre de usuario se concatena directamente con el comando sin ninguna sanitización. Esto permite a los atacantes inyectar comandos arbitrarios del sistema operativo en el parámetro de nombre de usuario. Los comandos inyectados se ejecutan con privilegios de root.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Type: Secondary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source	Type	Description
134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	en CWE-94

Affected Products

Vendor	Product	Version	Update	Type
lantronix	eds5032_firmware	2.1.0.0r3	<built-in method update of dict object at 0x7763a290abc0>	Operating System
lantronix	eds5008_firmware	2.1.0.0r3	<built-in method update of dict object at 0x7763a290bcc0>	Operating System
lantronix	eds5016_firmware	2.1.0.0r3	<built-in method update of dict object at 0x7763d84a1540>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0r3:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:lantronix:eds5032:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0r3:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:lantronix:eds5008:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0r3:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:lantronix:eds5016:-:::::::*`

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
Source: [email protected]

Third Party Advisory VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource