An issue in Lantronix EDS3000PS firmware v.3.1.0.0R2 enables an attacker to execute arbitrary code through the ltrx_evo component and obtain sensitive information. The weakness involves OS command injection (CWE‑78), weak cryptographic key storage (CWE‑620), and improper logging or error handling (CWE‑288), allowing a compromised device to run arbitrary commands and expose confidential data.

Devices referenced in the CPE data are the Lantronix EDS3008PS1NS and EDS3016PS1NS models running firmware version 3.1.0.0R2. While the CVE description names the EDS3000PS product, the provided CPE strings identify the EDS3008PS1NS/EDS3016PS1NS hardware, indicating that the vulnerability may affect these specific device variants with the cited firmware revision.

The CVSS base score of 9.8 classifies this flaw as critical, and an EPSS estimate under 1 % suggests that exploitation is currently unlikely. The vulnerability is not yet listed in CISA’s KEV catalog. The description does not specify authentication requirements; it is inferred that remote attackers able to reach the device over the network could invoke the ltrx_evo component and trigger the flaw, potentially leading to full system compromise and unauthorized data disclosure.