IM
IronMonkey Threat Research

CVE-2025-70082 CRITICAL

Published: 2026-03-11 | Last Modified: 2026-09-04 | Status: Modified

Description

The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.

Additional Descriptions (1)

Un problema en Lantronix EDS3000PS v.3.1.0.0R2 permite a un atacante ejecutar código arbitrario y obtener información sensible a través del componente ltrx_evo.

CVSS Metrics

Base Score: 2.7 (LOW)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactLOW
Availability ImpactNONE

Source: [email protected]

Type: Secondary

Exploitability Score: 1.2

Impact Score: 1.4

Base Score: 5.1 (MEDIUM)

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack VectorNETWORK
Attack ComplexityLOW
Attack RequirementsNONE
Privileges RequiredHIGH
User InteractionNONE
Vulnerability ConfidentialityNONE
Vulnerability IntegrityLOW
Vulnerability AvailabilityNONE
Subsequent ConfidentialityNONE
Subsequent IntegrityNONE
Subsequent AvailabilityNONE

Source: [email protected]

Type: Secondary

Weaknesses

Source Type Description
[email protected] Primary
en CWE-620
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-78
en CWE-288
en CWE-620

Affected Products

Vendor Product Version Update Type
lantronix eds3016ps1ns_firmware 3.1.0.0r2 <built-in method update of dict object at 0x7fd2a0420ac0> Operating System
lantronix eds3008ps1ns_firmware 3.1.0.0r2 <built-in method update of dict object at 0x7fd2a0423a00> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds3016ps1ns:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:lantronix:eds3008ps1ns:-:*:*:*:*:*:*:*

References