IM
IronMonkey Threat Research

CVE-2025-67041 CRITICAL

Published: 2026-03-11 | Last Modified: 2026-07-05 | Status: Modified

Description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

Additional Descriptions (1)

Se descubrió un problema en Lantronix EDS3000PS 3.1.0.0R2. El parámetro host del cliente TFTP en la página del navegador de archivos no se sanea correctamente. Esto puede explotarse para escapar del comando original y ejecutar uno arbitrario con privilegios de root.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Type: Secondary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source Type Description
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-78
en CWE-288
en CWE-620

Affected Products

Vendor Product Version Update Type
lantronix eds3016ps1ns_firmware 3.1.0.0r2 <built-in method update of dict object at 0x7763a06a13c0> Operating System
lantronix eds3008ps1ns_firmware 3.1.0.0r2 <built-in method update of dict object at 0x7763bb2c8180> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds3016ps1ns:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds3008ps1ns:-:*:*:*:*:*:*:*

References

Notification
Message here