CVE-2025-67039: An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2

Critical severity · published Mar 11, 2026

CVE-2025-67039

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2

9.8

CVSS

0.5%

EPSS

On KEV

Description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 39% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Eds3008ps1ns Firmware · Lantronix

3.1.0.0r2 · source: NVD

Eds3016ps1ns Firmware · Lantronix

3.1.0.0r2 · source: NVD

In the news

VulnerabilityCritical

Lantronix EDS3000PS and EDS5000

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges. The following versions of Lantronix EDS3000PS and EDS5000 are affected: EDS3000PS 3.1.0.0R2 (CVE-2025-67039, CVE-2025-70082, CVE-2025-67041) EDS5000 2.1.0.0R3 (CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, CVE-2025-67038) CVSS Vendor Equipment Vulnerabilities v3 9.8 Lantronix Lantronix EDS3000PS and EDS5000 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Authentication Bypass Using an Alternate Path or Channel, Unverified Password Change Background Critical Infrastructure Sectors: Communications, Information Technology, Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2025-67034 An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges. View CVE Details Affected Products Lantronix EDS3000PS and EDS5000 Vendor: Lantronix Product Version: Lantronix EDS5000: 2.1.0.0R3 Product Status: known_affected Remediations Vendor fix For vulnerabilities CVE-2025-67034, CVE...

CVE-2025-67039 CVE-2025-70082 CVE-2025-67041

Mar 10, 2026·CISA Advisories

Affected product

Eds3008ps1ns Firmware

Lantronix

All Eds3008ps1ns Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-67039

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-67039

github.com

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json

Third Party Advisory

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

www.lantronix.com

https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw