PT-2026-24722 · Lantronix · Eds5000 Series+5
CVE-2025-67034
·
Publicado
2026-03-11
·
Atualizado
2026-06-23
CVSS v3.1
7.2
Alta
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Lantronix EDS5000 version 2.1.0.0R3
Description
An authenticated attacker can inject operating system commands into the
name parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges. The affected API endpoint is the SSL credential deletion function within the management interface.Recommendations
Versions prior to 2.1.0.0R3 are potentially vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Code Injection
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Eds5000 Series
G520 Series
Srx300 Series
Eds5008 Firmware
Eds5016 Firmware
Eds5032 Firmware