An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 11, 2026 · NIST NVD

   Detected

   An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

2. Sep 4, 2026 · NIST NVD

   Updated

   An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

Affected

• cpe lantronix/eds3008ps1ns firmware3.1.0.0r2
• cpe lantronix/eds3016ps1ns firmware3.1.0.0r2

Sources

• CVE.orgVulnerability recordCVE-2025-67041

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-67041

  An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

  nvd.nist.gov

References

• Reference · github.com
• Third Party Advisory · cisa.gov
• Reference · lantronix.com