The vulnerability is an authentication bypass on management pages of Lantronix EDS3000PS devices running firmware 3.1.0.0R2. An attacker can append a specific suffix to the URL and send an Authorization header with username "admin", thereby bypassing authentication. This allows unauthorized access to the device's full management interface, potentially enabling configuration changes, data exposure, or denial of service. The weakness is identified as CWE-288: Authentication Bypass Without Authorization.

The affected systems are Lantronix EDS3000PS firmware 3.1.0.0R2, as described in the vendor's advisory. The provided CPE strings also list hardware models EDS3008PS1NS and EDS3016PS1NS running the same firmware version, so those models should be considered vulnerable. No other firmware versions are mentioned in the available data.

The CVSS score of 9.1 denotes a very high severity. The EPSS score of <1% indicates a low probability of exploitation at the time of reporting, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the device’s HTTP/HTTPS management interface; an attacker only needs to construct the correct URL suffix and set the Authorization header with username "admin". Successful exploitation grants full control over the device without valid credentials.