CVE-2025-70082
RCE in Lantronix Eds3016Ps1Ns Firmware 3.1.0.0r2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-70082 is a critical-severity OS Command Injection (CWE-78) vulnerability in Lantronix Eds3016Ps1Ns Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-70082 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in Lantronix EDS3000PS version 3.1.0.0R2, specifically within the ltrx_evo component. Published on 2026-03-11, it allows an attacker to execute arbitrary code and obtain sensitive information. The issue is linked to CWE-78 (OS Command Injection), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), and CWE-620 (Unverified Code).
Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation enables remote arbitrary code execution, resulting in high-impact compromise of confidentiality, integrity, and availability, potentially leading to full system control and exposure of sensitive data.
Mitigation details are outlined in vendor advisories available at eds3000ps.com and lantronix.com, as well as the CISA ICS Advisory ICSA-26-069-02 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208595
Vulnerability Data
An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 7 hardening rules · 3 OS baselines
V6.4.3V6.6.1V12.1.3V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Requires a tamperproof, always-invoked reference monitor that structurally blocks bypass via any alternate path.
Enforces authorization checks on every logical access path, eliminating unauthenticated alternate channels.
Re-authentication explicitly requires users to prove identity before performing sensitive actions such as password changes.
Mandates unique identification and authentication for all organizational users, covering the primary authentication requirement.
Authenticator management requires identity verification during password distribution and changes, directly stopping unverified password updates.
Developer testing and evaluation can discover missing or incorrect command sanitization during development.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication on every channel and path directly eliminates alternate-path bypasses.
Credential management practices directly enforce re-authentication for password changes.
Enforcing authorizations and least privilege across all access vectors prevents unauthenticated alternate paths.
Protecting networks and environments from unauthorized logical access blocks bypass via undocumented channels.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.
Secure authentication control directly mitigates bypass by requiring strong, consistent authentication on all paths.
Access control policy directly addresses alternate authentication paths by requiring all channels to enforce authentication.
Authentication information management ensures credentials and mechanisms are consistently applied across all access paths.
Access rights provisioning and review prevent bypass via unmonitored or alternate channels.
Privileged access rights control reduces risk of bypass through elevated or alternate paths.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248598 There must be no ".shosts" files on the OL 8 operating system. prevents CWE-288
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-288
Oracle Linux 9 (2 rules)
- V-271757 OL 9 file systems must not contain shosts.equiv files. prevents CWE-288
- V-271758 OL 9 file systems must not contain .shosts files. prevents CWE-288
RHEL 7 (3 rules)
- V-204440 Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes. prevents CWE-288
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-288
- V-204424 The Red Hat Enterprise Linux operating system must not allow accounts configured with blank or null passwords. prevents CWE-288