Lantronix EDS3000PS Authentication Bypass Using an Alternate Path or Channel
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Lantronix | EDS3000PS series | unaffected |
|
Configuration 1 [-]
| AND |
|
Configuration 2 [-]
| AND |
|
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Lantronix | Eds3000ps |
|
Vendor Solution
Latronix has released the following updates addressing this vulnerability. For more information, see the Latronix Vulnerability Library ( https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw ).
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.513% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Authentication Bypass on Lantronix EDS3000PS 3.1.0.0R2 Firmware | Lantronix EDS3000PS Authentication Bypass Using an Alternate Path or Channel |
| References |
|
|
| Metrics |
cvssV3_1
|
cvssV4_0
|
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Authentication Bypass on Lantronix EDS3000PS 3.1.0.0R2 Firmware |
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lantronix eds3008ps1ns
Lantronix eds3008ps1ns Firmware Lantronix eds3016ps1ns Lantronix eds3016ps1ns Firmware |
|
| CPEs | cpe:2.3:h:lantronix:eds3008ps1ns:-:*:*:*:*:*:*:* cpe:2.3:h:lantronix:eds3016ps1ns:-:*:*:*:*:*:*:* cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0:r2:*:*:*:*:*:* cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0:r2:*:*:*:*:*:* |
|
| Vendors & Products |
Lantronix eds3008ps1ns
Lantronix eds3008ps1ns Firmware Lantronix eds3016ps1ns Lantronix eds3016ps1ns Firmware |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-288 | |
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lantronix
Lantronix eds3000ps |
|
| Vendors & Products |
Lantronix
Lantronix eds3000ps |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username. | |
| References |
|