CVE-2025-67034

HighCVSS 7.2/10Last modified Sep 4, 2026

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2026
Last modified
Sep 4, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-670357.2An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilCVE-2025-670367.2An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a CVE-2025-670377.2An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when kiCVE-2025-670389.8An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authenticatioCVE-2025-670399.8An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific sufCVE-2025-67049.8An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) caCVE-2025-670417.2An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properCVE-2025-67055.3A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. SpecifCVE-2025-67068.8An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user dCVE-2025-670669.8SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /CVE-2025-67075.4Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized aCVE-2025-670708.2A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-