Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 6 products
| Date | Total | Labels |
|---|
| 2026-03-15 | 1 | Disclosure1 |
| 2026-06-23 | 1 | Patch1 |
🚨 HIGH severity CVE-2025-67034 (CVSS 8.8) Lantronix EDS5000 2.1.0.0R3 vulnerable to authenticated OS command injection via SSL credential deletion. Attacker gains root privileges. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/LfMu59epzB
Post summary
The tweet announces Lantronix EDS5000’s authenticated OS command injection vulnerability (CVE‑2025‑67034) that can grant root access, and urges immediate patching.
CVE-2025-67034 An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials throu… https://www.cve.org/CVERecord?id=CVE-2025-67034
Post summary
An authenticated command‑injection vulnerability was disclosed in Lantronix EDS5000, allowing attackers to execute OS commands via the name parameter during SSL credential deletion. No PoC, exploit, patch, or evidence of active exploitation is provided.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | lantronix | eds5008 | - | - | - |
| OS | lantronix | eds5008_firmware | 2.1.0.0r3 | - | - |
| HW | lantronix | eds5016 | - | - | - |
| OS | lantronix | eds5016_firmware | 2.1.0.0r3 | - | - |
| HW | lantronix | eds5032 | - | - | - |
| OS | lantronix | eds5032_firmware | 2.1.0.0r3 | - | - |