IM
IronMonkey Threat Research

CVE-2025-67041 CRITICAL

Published: 2026-03-11 | Last Modified: 2026-09-04 | Status: Modified

Description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

Additional Descriptions (1)

Se descubrió un problema en Lantronix EDS3000PS 3.1.0.0R2. El parámetro host del cliente TFTP en la página del navegador de archivos no se sanea correctamente. Esto puede explotarse para escapar del comando original y ejecutar uno arbitrario con privilegios de root.

CVSS Metrics

Base Score: 7.2 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Secondary

Exploitability Score: 1.2

Impact Score: 5.9

Base Score: 8.6 (HIGH)

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack VectorNETWORK
Attack ComplexityLOW
Attack RequirementsNONE
Privileges RequiredHIGH
User InteractionNONE
Vulnerability ConfidentialityHIGH
Vulnerability IntegrityHIGH
Vulnerability AvailabilityHIGH
Subsequent ConfidentialityNONE
Subsequent IntegrityNONE
Subsequent AvailabilityNONE

Source: [email protected]

Type: Secondary

Weaknesses

Source Type Description
[email protected] Primary
en CWE-78
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-78
en CWE-288
en CWE-620

Affected Products

Vendor Product Version Update Type
lantronix eds3016ps1ns_firmware 3.1.0.0r2 <built-in method update of dict object at 0x7fd3199950c0> Operating System
lantronix eds3008ps1ns_firmware 3.1.0.0r2 <built-in method update of dict object at 0x7fd2a0421a00> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds3016ps1ns:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds3008ps1ns:-:*:*:*:*:*:*:*

References