Research · Mar 11, 2026
Critical Code Injection Vulnerability Discovered in Lantronix EDS5000
A serious code injection vulnerability has been identified in the Lantronix EDS5000, allowing attackers to execute arbitrary commands with root privileges.
What changed
A significant security flaw has been uncovered in the Lantronix EDS5000, specifically in version 2.1.0.0R3. The vulnerability arises from the HTTP RPC module, which improperly handles user authentication failures.
This oversight permits attackers to inject malicious OS commands through the username input, as the system fails to sanitize the input before concatenation with the command.
Who is affected
The vulnerability primarily impacts users of the Lantronix EDS5000 series, particularly those utilizing the affected firmware version.
Organizations relying on this device for network management and logging may be at risk of unauthorized access and control.
- Lantronix EDS5000 series devices
- Users of firmware version 2.1.0.0R3
- Organizations managing network infrastructure with Lantronix products
What to do
It is essential for users of the affected firmware to assess their systems for potential exploitation of this vulnerability. Immediate action should be taken to mitigate risks.
Updating to a patched version or applying recommended security measures is crucial to protect against potential attacks.
- Review and update firmware to the latest version from Lantronix.
- Implement strict input validation and sanitization processes.
- Monitor network traffic for unusual activity related to the EDS5000.