Research · Mar 11, 2026 · ZeroDay Catalog
Critical Code Injection Vulnerability in Lantronix EDS5000
A critical code injection vulnerability has been identified in the Lantronix EDS5000, allowing attackers to execute arbitrary commands with root privileges.
What changed
A significant vulnerability has been discovered in the Lantronix EDS5000 firmware version 2.1.0.0R3. The flaw lies within the HTTP RPC module, which improperly handles user authentication failures.
Specifically, the system concatenates the username directly with a shell command used for logging without any sanitization, enabling potential code injection.
Who is affected
Organizations utilizing the Lantronix EDS5000, particularly those running the affected firmware version, are at risk of exploitation.
This vulnerability could impact various sectors that rely on the EDS5000 for device management and network connectivity.
- Lantronix EDS5000 users
- Enterprise environments using EDS5008 firmware
- Network administrators managing device security
What to do
Immediate action is recommended for affected users. It is crucial to assess the current firmware version and apply any available patches or updates from the vendor.
Additionally, implement monitoring for unusual activities that may indicate exploitation attempts.
- Upgrade to the latest firmware version provided by Lantronix.
- Review and strengthen authentication mechanisms.
- Monitor logs for any suspicious command executions.