CVE-2025-67041: Lantronix EDS3000PS OS command injection in TFTP client

CVE-2025-67041 · Severity: critical · CVSS 9.8 · Published 2026-03-11

A vulnerability exists in Lantronix EDS3000PS device servers, which are used to connect serial equipment to networks. An attacker can exploit a flaw in the device's file management interface to take complete control of the system with the highest level of access (root). This could lead to unauthorized data access, disruption of connected industrial equipment, or use of the device as a foothold for further network attacks.

Technologies: Lantronix EDS3000PS firmware, Lantronix Eds3008ps1ns, Lantronix Eds3008ps1ns Firmware, Lantronix Eds3016ps1ns, Lantronix Eds3016ps1ns Firmware. Vendors: Lantronix.

Quick answers

Is CVE-2025-67041 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-67041 being exploited in the wild.
How severe is CVE-2025-67041?
Critical severity, with a CVSS score of 9.8, published 11 March 2026.
Which products and versions are affected?
Lantronix EDS3000PS firmware 3.1.0.0R2; Lantronix Eds3008ps1ns Firmware 3.1.0.0R2; Lantronix Eds3016ps1ns Firmware 3.1.0.0R2.
Is there a fix for CVE-2025-67041?
A patch was published on 2026-03-11: Lantronix released EDS3000PS version 3.2.0.0R2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67041 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2025-67041?
Check whether you run Lantronix EDS3000PS firmware, Lantronix Eds3008ps1ns, Lantronix Eds3008ps1ns Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in the Lantronix EDS3000PS firmware version 3.1.0.0R2. The vulnerability is located in the 'host' parameter of the TFTP client within the Filesystem Browser page, which fails to properly sanitize user input. While command injection typically requires authentication, this vulnerability is often discussed in the context of associated authentication bypass flaws (CWE-288) in the same product, leading to a CVSS score of 9.8. An attacker can use shell metacharacters to escape the intended TFTP command and execute arbitrary system commands as the root user. Lantronix recommends upgrading to EDS3000PS version 3.2.0.0R2 to resolve this issue.

Affected products

  • Lantronix EDS3000PS firmware 3.1.0.0R2
  • Lantronix EDS3008PS1NS firmware 3.1.0.0R2
  • Lantronix EDS3016PS1NS firmware 3.1.0.0R2

Timeline

  • 2026-03-10: advisory: CISA ICS Advisory ICSA-26-069-02 published
  • 2026-03-11: disclosed: CVE published to NVD
  • 2026-03-11: patched: Lantronix released EDS3000PS version 3.2.0.0R2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.