An authenticated OS command injection vulnerability exists in the Lantronix EDS series firmware, specifically during the deletion of SSL credentials via the management interface. The flaw arises from improper validation of the "name" parameter, allowing an attacker to inject arbitrary operating system commands. The injected commands are executed with root privileges, giving full control over the device. This vulnerability is classified as CWE-94 – Improper Constraint on Regular Expression or similar Input Validation, leading to remote command execution that can compromise confidentiality, integrity, and availability of the affected system.

Affected products include Lantronix EDS5008, EDS5016, and EDS5032 devices running firmware versions 2.1.0.0 r3. The specific CPE identifiers are: cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3, cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3, and cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3. Hardware models listed are cpe:2.3:h:lantronix:eds5008, cpe:2.3:h:lantronix:eds5016, and cpe:2.3:h:lantronix:eds5032.

The vulnerability has a CVSS score of 8.8, indicating high severity, yet the EPSS score is less than 1%, suggesting a low current exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation requires valid authentication to the management interface, indicating an insider or credential-compromised attack scenario. Successful exploitation would enable an attacker to gain root-level access and potentially disrupt or exfiltrate data from the device.