CVE-2025-67036
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Lantronix EDS5000, G520, and X300 OS Command Injection
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
EDS5000 series
- Vendor
- Lantronix
- Product
- EDS5000 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | Unavailable | 2.1.0.0R3 | None listed |
| 2.2.0.0R1 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
G520 series
- Vendor
- Lantronix
- Product
- G520 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 2.6.0.4R6 | Unavailable | None listed |
| 2.6.0.4R6 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
X300 series
- Vendor
- Lantronix
- Product
- X300 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 2.6.0.4R6 | Unavailable | None listed |
| 2.6.0.4R6 | unaffected | Unavailable | Unavailable | Unavailable | None listed |