An issue was discovered in Lantronix EDS5000 2.1.0.0R3.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 11, 2026 · NIST NVD

   Detected

   An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

2. Sep 4, 2026 · NIST NVD

   Updated

   An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

Affected

• cpe lantronix/eds5008 firmware2.1.0.0r3
• cpe lantronix/eds5016 firmware2.1.0.0r3
• cpe lantronix/eds5032 firmware2.1.0.0r3

Sources

• CVE.orgVulnerability recordCVE-2025-67034

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-67034

  An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

  nvd.nist.gov

References

• Reference · github.com
• Third Party Advisory · cisa.gov
• Reference · lantronix.com