CVE-2025-67034
Published: 11 March 2026
Summary
CVE-2025-67034 is a high-severity Code Injection (CWE-94) vulnerability in Lantronix Eds5032 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates command injection by requiring validation and sanitization of inputs like the 'name' parameter in the management interface.
Requires timely flaw remediation, such as applying vendor patches for this specific command injection vulnerability in Lantronix EDS5000.
Enforces least privilege to limit the impact of root-privilege command execution even if injection occurs through low-privilege authentication.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in remotely accessible management interface enables T1190 exploitation for root-level Unix shell command execution (T1059.004) and privilege escalation (T1068).
NVD Description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.
Deeper analysisAI
CVE-2025-67034 is a command injection vulnerability (CWE-94) discovered in Lantronix EDS5000 version 2.1.0.0R3, published on 2026-03-11. The issue resides in the management interface, where an authenticated attacker can inject arbitrary OS commands into the "name" parameter during the deletion of SSL credentials. These injected commands execute with root privileges, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker requires only low privileges (PR:L) to exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants root-level command execution on the device, enabling full compromise including data exfiltration, modification of configurations, or further persistence.
Advisories providing mitigation guidance, including potential patches or workarounds, are detailed in CISA ICSA-26-069-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02) and on vendor sites such as http://eds5000.com and http://lantronix.com.
Details
- CWE(s)