CVE-2025-67041

Lantronix EDS3000PS OS Command Injection

Published Mar 11, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

Analysis

Technical impact

An improper sanitization of the host parameter in the TFTP client on Lantronix EDS3000PS firmware 3.1.0.0 R2 allows an attacker to inject and execute arbitrary commands with root privileges, constituting a remote code execution vulnerability. The weakness is identified as CWE-288, CWE-620, and CWE-78. The potential impact is that a compromised device could deliver any payload to the host system, jeopardizing the confidentiality, integrity, and availability of the entire connected network.

Affected Systems

Affected systems include Lantronix EDS3008PS1NS and EDS3016PS1NS devices running firmware version 3.1.0.0 R2. No other models or firmware are listed as impacted.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. The EPSS score of less than 1% suggests exploitable code is not widely observed today, and the vulnerability is not present in the CISA KEV catalog. It is likely exploitable remotely via the web interface’s TFTP client; an attacker with network access to the device’s web interface can supply a crafted host parameter to trigger the exploit. Because the vulnerability grants root privileges without additional prerequisites, the risk for an attacker with web access is high.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Lantronix

EDS3000PS series

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.1.0.0R2
`3.2.0.0R2`	unaffected	—

Configuration 1 [-]

AND

cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

cpe:2.3:h:lantronix:eds3016ps1ns:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*

cpe:2.3:h:lantronix:eds3008ps1ns:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Lantronix

Eds3000ps

Version	Status	Scheme	Platform
`3.1.0.0R2`	affected	generic	—

Remediation

Vendor Solution

Latronix has released the following updates addressing this vulnerability. For more information, see the Latronix Vulnerability Library ( https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw ).

OpenCVE Recommended Actions

Apply the latest firmware update that addresses the TFTP host parameter sanitization flaw; if no patch is available, obtain an updated firmware from Lantronix.
If immediate firmware update is not possible, disable the TFTP client feature within the Filesystem Browser page or restrict its use to trusted IP addresses.
Limit access to the web interface by implementing network segmentation or firewall rules to allow only trusted management hosts.
Monitor device logs for anomalous command execution attempts and review any suspicious activity promptly.

Generated by OpenCVE AI on September 4, 2026 at 23:36 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.488% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw

History

Sep 4, 2026 8:45 PM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Lantronix EDS3000PS TFTP Command Injection Exploit	Lantronix EDS3000PS OS Command Injection
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`	cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}` cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

Mar 20, 2026 2:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Lantronix EDS3000PS TFTP Command Injection Exploit

Mar 19, 2026 8:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Lantronix eds3008ps1ns Lantronix eds3008ps1ns Firmware Lantronix eds3016ps1ns Lantronix eds3016ps1ns Firmware
CPEs		cpe:2.3:h:lantronix:eds3008ps1ns:-:::::::* cpe:2.3:h:lantronix:eds3016ps1ns:-:::::::* cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0:r2:::::: cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0:r2::::::
Vendors & Products		Lantronix eds3008ps1ns Lantronix eds3008ps1ns Firmware Lantronix eds3016ps1ns Lantronix eds3016ps1ns Firmware

Mar 12, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Lantronix Lantronix eds3000ps
Vendors & Products		Lantronix Lantronix eds3000ps

Mar 11, 2026 8:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-288 CWE-620 CWE-78
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mar 11, 2026 4:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.
References		http://eds3000ps.com http://lantronix.com https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

Earlier changes (1)

Subscriptions

Lantronix Eds3000ps Eds3008ps1ns Eds3008ps1ns Firmware Eds3016ps1ns Eds3016ps1ns Firmware

Weaknesses

CWE-288
Authentication Bypass Using an Alternate Path or Channel
CWE-620
Unverified Password Change
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')