An authenticated attacker can inject OS commands into the 'tunnel' parameter when terminating a tunnel on Lantronix EDS5000 devices running firmware 2.1.0.0 r3. This injection causes the commands to execute with root privileges, effectively granting the attacker full system control. The vulnerability is classified as Command Injection (CWE‑94). With a CVSS score of 8.8, the defect presents high severity, allowing remote code execution that can compromise confidentiality, integrity, and availability.

Affected devices include Lantronix EDS5008, EDS5016, and EDS5032 models. All are vulnerable when running firmware version 2.1.0.0 r3, as indicated by the CPE entries and the recommendation that this specific firmware revision exhibits the flaw. No other versions are documented as affected in the provided data.

The EPSS score is reported as less than 1%, suggesting a low likelihood of observed exploitation events, and the vulnerability is not listed in the CISA KEV catalog. However, the high CVSS score and the fact that the flaw requires authenticated access to a management function mean that an attacker who gains credentials could immediately exploit the device. The attack vector is likely through the device’s management interface or any API that allows a user to terminate a tunnel connection. Since no workaround or patch is referenced in the data, the primary risk remains until a vendor update becomes available.