The vulnerability occurs in the HTTP RPC module of Lantronix EDS5000 versions 2.1.0.0 R3 where an authentication failure log command is constructed by directly concatenating the supplied username into a shell command. This lack of input sanitization allows an attacker to inject and execute arbitrary OS commands. Because the command is run with root privileges, the impact is full system compromise with potentially unlimited control over the device and connected network. Key weakness: CWE‑94 – Improper Control of Generation of Code via User-Supplied Input.

Affected products are Lantronix EDS5000 series devices, specifically models EDS5008, EDS5016 and EDS5032 running firmware version 2.1.0.0 R3. CPE identifiers include cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3, cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3, and cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3.

The CVSS score of 9.8 indicates a critical severity with an attack vector over the network. Although the EPSS score is below 1%, meaning current exploitation likelihood is low, the lack of a public exploit and KEV listing does not diminish the risk if a malicious actor targets these widely deployed industrial controllers. A remote attacker can craft a username containing shell commands, trigger an authentication failure, and have those commands executed as root via the HTTP RPC interface. Due to the root execution context, any command such as creating backdoors, exfiltrating data, or interrupting services can be performed.