An authenticated attacker can inject OS commands into the 'tunnel' parameter when terminating a tunnel on Lantronix EDS5000 devices running firmware 2.1.0.0 r3. This injection causes the commands to execute with root privileges, effectively granting the attacker full system control. The vulnerability is classified as Command Injection (CWE-78, CWE-94). With a CVSS score of 8.6, the defect presents high severity, allowing remote code execution that can compromise confidentiality, integrity, and availability.

Affected devices include Lantronix EDS5008, EDS5016, and EDS5032 models, as well as the G520 and X300 series. All are vulnerable when running firmware version 2.1.0.0 r3, as indicated by the CPE entries and the recommendation that this specific firmware revision exhibits the flaw. No other versions are documented as affected in the provided data.

The EPSS score is reported as less than 1%, suggesting a low likelihood of observed exploitation events, and the vulnerability is not listed in the CISA KEV catalog. However, the high CVSS score and the fact that the flaw requires authenticated access to a management function mean that an attacker who gains credentials could immediately exploit the device. The attack vector is likely through the device’s management interface or any API that allows a user to terminate a tunnel connection. Vendor‑issued firmware updates are available that patch the flaw: upgrade to version 2.2.0.0R1 or later for the EDS5000 series and to version 2.6.0.4R6 or later for the G520 and X300 series. Once these updates are applied the vulnerability is eliminated.