Vulnerability · Published Mar 11, 2026 · Assigned by mitre
CVE-2025-70082Lantronix EDS3000PS Unverified Password Change
Low 2.7
In plain English
A low-severity OS command injection in EDS3000PS series from Lantronix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lantronix | EDS3000PS series | 0 – through 3.1.0.0R2 |
Weakness: CWE-620, CWE-78, CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json