Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 6 products
| Date | Total | Labels |
|---|
| 2026-03-15 | 1 | Disclosure1 |
| 2026-06-23 | 1 | Patch1 |
🚨 CRITICAL: CVE-2025-67035 (CVSS 9.8) Lantronix EDS5000 2.1.0.0R3 vulnerable to OS command injection via SSH Client/Server pages. Unauthenticated remote attackers can execute commands as root. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/3ilAeX96cJ
Post summary
Lantronix EDS5000 is vulnerable to OS command injection (CVE‑2025‑67035, CVSS 9.8); a patch is urgently required.
CVE-2025-67035 An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanit… https://www.cve.org/CVERecord?id=CVE-2025-67035
Post summary
The statement announces that Lantronix EDS5000 2.1.0.0R3 suffers OS injection flaws on its SSH pages due to missing sanitization, but does not mention a PoC, exploit, or mitigation.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | lantronix | eds5008 | - | - | - |
| OS | lantronix | eds5008_firmware | 2.1.0.0r3 | - | - |
| HW | lantronix | eds5016 | - | - | - |
| OS | lantronix | eds5016_firmware | 2.1.0.0r3 | - | - |
| HW | lantronix | eds5032 | - | - | - |
| OS | lantronix | eds5032_firmware | 2.1.0.0r3 | - | - |