Technical impact
Lantronix firmware for the EDS3000PS series allows an attacker to change the administrator password without providing the current password, effectively bypassing normal authentication checks. This flaw can be chained with an authentication‑bypass vulnerability to grant unauthenticated users the ability to modify the admin credentials, thereby gaining full administrative control over the device. The weakness corresponds to insufficient authentication enforcement, as identified by CWE‑288 and related input validation problems.
Affected Systems
Hardware products affected are the Lantronix EDS3008PS1NS and EDS3016PS1NS models running firmware version 3.1.0.0R2. The vendor recommends upgrading to firmware 3.2.0.0R2 or later. Although the CVE title references the broader EDS3000PS series, the CPE strings specifically point to these two hardware variants, indicating that the vulnerability applies to them at the cited firmware revision.
Risk and Exploitability
The CVSS base score of 5.1 classifies this flaw as moderate, while an EPSS estimate of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. If an attacker can reach the device’s password change endpoint—potentially without verifying the current password or through an authentication bypass—they could change the administrator credentials and take full control. The attack vector is likely over the network, requiring the device to be reachable from the attacker’s environment.
