Vulnerabilidades do Lantronix X300 series
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Lantronix X300 series: 4 registro(s), com versões afetadas e correções.
CVE-2025-67038
Crítica · 9.8
KEV Alta · 69 Exploit público CWE-78 11/03/2026
Lantronix EDS5000 Code Injection Vulnerability
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
CVE-2025-67037
Alta · 7.2
CWE-78 11/03/2026
Lantronix EDS5000, G520, and X300 OS Command Injection
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.
CVE-2025-67036
Alta · 7.2
CWE-78 11/03/2026
Lantronix EDS5000, G520, and X300 OS Command Injection
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
CVE-2025-67034
Alta · 7.2
CWE-78 11/03/2026
Lantronix EDS5000, G520, and X300 OS Command Injection
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.