CVE-2025-67041: Lantronix EDS3000PS OS Command Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-11 · updated 2026-09-04
Weakness: CWE-78

Description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.

Affected products

LANTRONIX Eds3008Ps1Ns Firmware: 3.1.0.0r2
LANTRONIX Eds3016Ps1Ns Firmware: 3.1.0.0r2

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw

Get alerted when CVE-2025-67041 or the next vulnerability affects your stack