Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2025-67038

Lantronix EDS5000, G520, and X300 OS Command Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Lantronix EDS5000 series

Default version status: unaffected

  • 0 to ≤ 2.1.0.0R3affected
  • 2.2.0.0R1unaffected

Lantronix G520 series

Default version status: unaffected

  • 0 to < 2.6.0.4R6affected
  • 2.6.0.4R6unaffected

Lantronix X300 series

Default version status: unaffected

  • 0 to < 2.6.0.4R6affected
  • 2.6.0.4R6unaffected

Lantronix E210 series

Default version status: unaffected

  • 0 to < 3.21.0.0R1affected
  • 3.21.0.0R1unaffected

Lantronix E220 series

Default version status: unaffected

  • 0 to < 3.21.0.0R1affected
  • 3.21.0.0R1unaffected

References