CVE-2025-67038 Lantronix EDS5000 Series
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to…
- CVSS
- 9.8 Critical
- EPSS
- 21%
- Percentile
- 98
- Published
- 2026-03-11
- Force
- 11 of 12
- Public PoC
- 1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
Lantronix EDS5000 Code Injection Vulnerability
- Added
- 2026-06-23
- Federal patch deadline
- 2026-06-26
- Ransomware use
- not known