The vulnerability occurs in the HTTP RPC module of Lantronix EDS5000 versions 2.1.0.0 R3 where an authentication failure log command is constructed by directly concatenating the supplied username into a shell command. This lack of input sanitization allows an attacker to inject and execute arbitrary OS commands. Because the command is run with root privileges, the impact is full system compromise with potentially unlimited control over the device and connected network. Key weakness: CWE‑94 – Improper Control of Generation of Code via User‑Supplied Input.

Affected products are Lantronix EDS5000 series devices, including the EDS5008, EDS5016, and EDS5032 models, all running firmware version 2.1.0.0 R3.

The CVSS score of 9.8 indicates a critical severity with an attack vector over the network. Although the EPSS score is below 1%, the CVE’s addition to the CISA KEV catalog indicates it is a known, potentially actively exploited vulnerability. The lack of a publicly known exploit does not diminish the risk if attackers target these devices. A remote attacker can craft a username containing shell commands, trigger an authentication failure, and have those commands executed as root via the HTTP RPC interface. Due to the root execution context, any command such as creating backdoors, exfiltrating data, or interrupting services can be performed.