Critical Auth Bypass and OS Command Injection Vulnerabilities in Lantronix EDS3000PS & EDS5000 (CVE‑2025‑67034‑CVE‑2025‑70082) Threaten Industrial Control Systems
What It Is — A cluster of eight CVEs (CVE‑2025‑67034, CVE‑2025‑67035, CVE‑2025‑67036, CVE‑2025‑67037, CVE‑2025‑67038, CVE‑2025‑67039, CVE‑2025‑67041, CVE‑2025‑70082) affect Lantronix EDS3000PS (v3.1.0.0R2) and EDS5000 (v2.1.0.0R3). The flaws permit authentication bypass and OS‑command injection, granting attackers root‑level code execution on the device.
Exploitability — Proof‑of‑concept exploits have been released; the vulnerabilities carry a CVSS v3.0 base score of 9.8 (Critical) and are considered actively exploitable in the wild.
Affected Products — Lantronix EDS3000PS 3.1.0.0R2 and Lantronix EDS5000 2.1.0.0R3.
TPRM Impact — Compromise of these industrial‑control devices can cascade through supply chains, exposing downstream manufacturers, communications providers, and IT service firms to operational disruption, data leakage, and ransomware insertion.
Recommended Actions —
- Apply Lantronix’s remediation patches without delay.
- Conduct an inventory sweep to identify any unpatched EDS3000PS/EDS5000 units.
- Isolate affected hardware on segmented VLANs and enforce strict access controls.
- Enable continuous monitoring for anomalous command‑execution activity.
- Review third‑party contracts to ensure vendors have applied the fixes.
Source: CISA Advisory – ICSA‑26‑069‑02