Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2025-67038

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

CVSS 4.0 · 9.3 Critical EPSS 21.1% KEV · Listed
Vendors
Lantronix
Products
E213f102s E213f102s Firmware E214f002s and 64 more
CVE-2025-67037

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Lantronix
Products
Eds5000 Eds5008 Eds5008 Firmware and 4 more
CVE-2025-67034

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Lantronix
Products
Eds5000 Eds5008 Eds5008 Firmware and 4 more
CVE-2025-67036

Lantronix EDS5000, G520, and X300 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Lantronix
Products
Eds5000 Eds5008 Eds5008 Firmware and 4 more
CVE-2025-67035

Lantronix EDS5000 OS Command Injection

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Lantronix
Products
Eds5000 Eds5008 Eds5008 Firmware and 4 more