OS Command Injection Vulnerability in Lantronix EDS5000
CVE-2025-67037

8.8HIGH

Key Information:

Vendor

Lantronix

Status
EDS5000
Vendor
CVE Published:
11 March 2026

What is CVE-2025-67037?

A vulnerability exists in the Lantronix EDS5000, where an authenticated attacker can exploit the 'tunnel' parameter during a tunnel connection termination. This flaw allows attackers to inject OS commands that execute with root privileges, potentially compromising the integrity of the system. It is crucial for users of the EDS5000 to evaluate their exposure to this issue and apply necessary security updates to mitigate risks.

References

http://lantronix.com
http://eds5000.com
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.