An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Mar 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lantronix
Lantronix eds5000 |
|
| Vendors & Products |
Lantronix
Lantronix eds5000 |
Wed, 11 Mar 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges. | |
| References |
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-03-11T16:08:35.626Z
Reserved: 2025-12-08T00:00:00.000Z
Link: CVE-2025-67034
No data.
Status : Received
Published: 2026-03-11T17:16:50.393
Modified: 2026-03-11T17:16:50.393
Link: CVE-2025-67034
No data.
OpenCVE Enrichment
Updated: 2026-03-12T10:06:40Z
Weaknesses
No weakness.