CVE-2025-67038
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Lantronix EDS5000, G520, and X300 OS Command Injection
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
EDS5000 series
- Vendor
- Lantronix
- Product
- EDS5000 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | Unavailable | 2.1.0.0R3 | None listed |
| 2.2.0.0R1 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
G520 series
- Vendor
- Lantronix
- Product
- G520 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 2.6.0.4R6 | Unavailable | None listed |
| 2.6.0.4R6 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
X300 series
- Vendor
- Lantronix
- Product
- X300 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 2.6.0.4R6 | Unavailable | None listed |
| 2.6.0.4R6 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
E210 series
- Vendor
- Lantronix
- Product
- E210 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 3.21.0.0R1 | Unavailable | None listed |
| 3.21.0.0R1 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
E220 series
- Vendor
- Lantronix
- Product
- E220 series
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 3.21.0.0R1 | Unavailable | None listed |
| 3.21.0.0R1 | unaffected | Unavailable | Unavailable | Unavailable | None listed |