An OS injection vulnerability exists in the SSH Client and SSH Server pages of Lantronix EDS5000 firmware 2.1.0.0R3 due to missing input sanitization. The flaw allows an attacker to inject arbitrary shell commands into delete actions for objects such as server keys, users, and known hosts. Because the commands are executed with root privileges, the impact is Remote Code Execution. The weakness corresponds to CWE‑94, which describes the execution of injected code. Based on the description, it is inferred that the vulnerability can be exploited remotely via the web‑based management interface or SSH client web pages, though the exact attack vector is not explicitly stated.

Affected systems include Lantronix EDS5008, EDS5016, and EDS5032 devices running firmware version 2.1.0.0R3. The Common Platform Enumeration identifiers for these products and firmware versions are: cpe:2.3:h:lantronix:eds5008:-:*:*:*:*:*:*:*, cpe:2.3:h:lantronix:eds5016:-:*:*:*:*:*:*:*, cpe:2.3:h:lantronix:eds5032:-:*:*:*:*:*:*:*, cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3:*:*:*:*:*:*, cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3:*:*:*:*:*:*, cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3:*:*:*:*:*:*.

The CVSS v3.1 score of 9.8 indicates a critical severity, meaning the vulnerability can have a severe impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS still warrants proactive action. Without a publicly disclosed exploit, the attack may require an authenticated or at least network‑visible presence on the device, but any valid input to the affected delete endpoints can be used to execute malicious root commands.