An improper sanitization of the host parameter in the TFTP client on Lantronix EDS3000PS firmware 3.1.0.0 R2 allows an attacker to inject and execute arbitrary commands with root privileges, constituting a remote code execution vulnerability. The weakness is identified as CWE-288, CWE-620, and CWE-78. The potential impact is that a compromised device could deliver any payload to the host system, jeopardizing the confidentiality, integrity, and availability of the entire connected network.

Affected systems include Lantronix EDS3008PS1NS and EDS3016PS1NS devices running firmware version 3.1.0.0 R2. No other models or firmware are listed as impacted.

The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% suggests exploitable code is not widely observed today, and the vulnerability is not present in the CISA KEV catalog. It is likely exploitable remotely via the web interface’s TFTP client; an attacker with network access to the device’s web interface can supply a crafted host parameter to trigger the exploit. Because the vulnerability grants root privileges without additional prerequisites, the risk for an attacker with web access is high.