Lantronix EDS3000PS Unverified Password Change
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Lantronix | EDS3000PS series | unaffected |
|
Configuration 1 [-]
| AND |
|
Configuration 2 [-]
| AND |
|
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Lantronix | Eds3000ps |
|
Vendor Solution
Latronix has released the following updates addressing this vulnerability. For more information, see the Latronix Vulnerability Library ( https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw ).
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.537% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component | The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password. |
| Title | Arbitrary Code Execution via ltrx_evo Component in Lantronix EDS3000PS Firmware 3.1.0.0R2 | Lantronix EDS3000PS Unverified Password Change |
| References |
|
|
| Metrics |
cvssV3_1
|
cvssV4_0
|
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Arbitrary Code Execution via ltrx_evo Component in Lantronix EDS3000PS Firmware 3.1.0.0R2 |
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lantronix eds3008ps1ns
Lantronix eds3008ps1ns Firmware Lantronix eds3016ps1ns Lantronix eds3016ps1ns Firmware |
|
| CPEs | cpe:2.3:h:lantronix:eds3008ps1ns:-:*:*:*:*:*:*:* cpe:2.3:h:lantronix:eds3016ps1ns:-:*:*:*:*:*:*:* cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0:r2:*:*:*:*:*:* cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0:r2:*:*:*:*:*:* |
|
| Vendors & Products |
Lantronix eds3008ps1ns
Lantronix eds3008ps1ns Firmware Lantronix eds3016ps1ns Lantronix eds3016ps1ns Firmware |
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lantronix
Lantronix eds3000ps |
|
| Vendors & Products |
Lantronix
Lantronix eds3000ps |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-288 CWE-620 CWE-78 |
|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component | |
| References |
|