Authentication Bypass in Lantronix EDS3000PS Management Interface
CVE-2025-67039

9.1CRITICAL

Key Information:

Vendor

Lantronix

Status
EDS3000PS
Vendor
CVE Published:
11 March 2026

What is CVE-2025-67039?

A security flaw has been identified in the Lantronix EDS3000PS management interface that allows unauthorized users to bypass authentication mechanisms. By appending a specific suffix to the URL and utilizing 'admin' as the username in the Authorization header, an attacker can gain access to restricted management pages. This vulnerability poses a risk of unauthorized control over the device, potentially leading to further exploits.

References

http://lantronix.com
http://eds3000ps.com
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.