VULNERABILITY INTELLIGENCE

CVE-2025-67034

CVSS score7.2 HIGH
EPSS probability0.53%
CISA KEVNot currently listed
Published2026-03-11
Last modified2026-09-04
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

Weakness classification

  • ics-cert@hq.dhs.gov: CWE-78
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94

Primary references