Vulnerability · Published Mar 11, 2026 · Assigned by mitre
CVE-2025-67035Lantronix EDS5000 OS Command Injection
High 7.2
In plain English
A high-severity OS command injection in EDS5000 series from Lantronix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lantronix | EDS5000 series | 0 – through 2.1.0.0R3 |
Weakness: CWE-78, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json