CVE-2025-67035: Lantronix EDS5000 OS command injection in SSH management pages

CVE-2025-67035 · Severity: critical · CVSS 9.8 · Published 2026-03-11

Lantronix EDS5000 series devices, which are used to connect and manage industrial equipment over a network, contain a security flaw in their SSH management interface. An attacker with administrative access can exploit this flaw to take full control of the device by executing unauthorized commands. This could lead to a complete compromise of the device, allowing an attacker to disrupt operations or access sensitive data within the industrial network.

Technologies: Lantronix EDS5000 firmware, Lantronix Eds5008, Lantronix Eds5008 Firmware, Lantronix Eds5016, Lantronix Eds5016 Firmware, Lantronix Eds5032, Lantronix Eds5032 Firmware. Vendors: Lantronix.

Quick answers

Is CVE-2025-67035 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-67035 being exploited in the wild.
How severe is CVE-2025-67035?
Critical severity, with a CVSS score of 9.8, published 11 March 2026.
Which products and versions are affected?
Lantronix EDS5000 firmware 2.1.0.0R3; Lantronix Eds5008 2.1.0.0R3; Lantronix Eds5016 2.1.0.0R3; Lantronix Eds5032 2.1.0.0R3.
Is there a fix for CVE-2025-67035?
A patch was published on 2026-03-11: Vendor released firmware version 2.2.0.0R1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67035 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-67035?
Check whether you run Lantronix EDS5000 firmware, Lantronix Eds5008, Lantronix Eds5008 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple OS command injection vulnerabilities exist in the SSH Client and SSH Server management pages of Lantronix EDS5000 firmware version 2.1.0.0R3. The root cause is a failure to properly sanitize input parameters during 'delete' actions for objects such as server keys, users, and known hosts. An authenticated attacker with high privileges can inject arbitrary shell commands that are executed with root-level permissions. While CISA-ADP initially assigned a CVSS 9.8, the specific technical advisory for this CVE (CVE-2025-67035) indicates it requires authentication (PR:H), resulting in a CVSS 7.2. Users are advised to upgrade to firmware version 2.2.0.0R1 to remediate these issues.

Affected products

  • Lantronix EDS5000 firmware 2.1.0.0R3
  • Lantronix EDS5008 2.1.0.0R3
  • Lantronix EDS5016 2.1.0.0R3
  • Lantronix EDS5032 2.1.0.0R3

Timeline

  • 2026-03-10: advisory: CISA ICS Advisory ICSA-26-069-02 published
  • 2026-03-11: disclosed: CVE published in NVD
  • 2026-03-11: patched: Vendor released firmware version 2.2.0.0R1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.