CVE-2025-67041highCWE-288CWE-620CWE-78

CVE-2025-67041: high-severity vulnerability in Lantronix EDS3000PS series

Lantronix EDS3000PS OS Command Injection

Published · Updated

Follow this CVE+ Monitor EDS3000PS series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.5%
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Lantronix · EDS3000PS series
Related CVEs — Lantronix EDS3000PS series

In the same product, most dangerous first.

CVE-2025-70082MEDIUMLantronix EDS3000PS Unverified Password ChangeEPSS 0.5%CVE-2025-67039CRITICALLantronix EDS3000PS Authentication Bypass Using an Alternate Path or ChannelEPSS 0.5%