CVE-2025-67039Active Exploitation(lantronix / eds3008ps1ns)

MEDIUMCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for lantronix eds3008ps1ns systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

lantronix CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

Other references

Weakness type (CWE)

CWE-288

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

eds3008ps1ns
eds3008ps1ns_firmware
eds3016ps1ns
eds3016ps1ns_firmware

Threat summary

Active exploitation appears in 1 classified signals
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-03-11); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

lantronix

Products

eds3008ps1nseds3008ps1ns_firmwareeds3016ps1nseds3016ps1ns_firmware

2 versions affected across 4 products

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Active Exploitation

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-11	1	Active Exploitation1
2026-03-15	1	Disclosure1

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc211d
Active Exploitation
TRC analysis shows attackers chaining authentication bypass (CVE-2025-67039) with OS command injection flaws to gain root access on Lantronix devices. Root compromise enables lateral movement across network infrastructure. Runtime segmentation helps contain post-compromise pivoting in critical infrastructure environments. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/lantronix-eds3000ps-eds5000-vulnerabilities-2026
Post summary
Attackers are actively exploiting CVE‑2025‑67039 by chaining it with OS command injection to gain root on Lantronix devices, enabling lateral movement within networks.
00010121
1.9K followersView on X
CVE@CVEnew207d
Disclosure
CVE-2025-67039 An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by send… https://www.cve.org/CVERecord?id=CVE-2025-67039
Post summary
CVE‑2025‑67039 is an authentication bypass vulnerability in Lantronix EDS3000PS, discovered by URL manipulation; the announcement provides technical details but no exploit, patch, or active exploitation information.
00000217
56.7K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	lantronix	eds3008ps1ns	-	-	-
OS	lantronix	eds3008ps1ns_firmware	3.1.0.0r2	-	-
HW	lantronix	eds3016ps1ns	-	-	-
OS	lantronix	eds3016ps1ns_firmware	3.1.0.0r2	-	-

Explore more

Back to dashboard lantronix CVEs eds3008ps1ns vulnerabilities