CRITICAL🇵🇱 Wersja polska

CVE-2025-67039

CVSS 9.1v3.1pub. 2026-03-11upd. 2026-07-05

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Lantronix Eds3008ps1ns

    HW
    Lantronix
    wszystkie wersje

  • Lantronix Eds3008ps1ns Firmware

    OS
    Lantronix
    3.1.0.0r2

  • Lantronix Eds3016ps1ns

    HW
    Lantronix
    wszystkie wersje

  • Lantronix Eds3016ps1ns Firmware

    OS
    Lantronix
    3.1.0.0r2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-67041CRITICAL9.8PL ✓ten sam produkt

Command injection w parametrze host klienta TFTP urządzeń Lantronix EDS3000PS

CVE-2025-70082CRITICAL9.8PL ✓ten sam produkt

RCE i ujawnienie danych w Lantronix EDS3000PS via ltrx_evo

CVE-2025-67038CRITICAL9.8⚠ KEVPL ✓ten sam vendor

Command injection w Lantronix EDS5000 – wykonanie poleceń jako root

CVE-2025-67035CRITICAL9.8PL ✓ten sam vendor

OS command injection w Lantronix EDS5000 — wykonanie kodu jako root

CVE-2021-21872CRITICAL9.9ten sam vendor

An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantr...