{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-67037", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-12T14:41:47.973Z", "dateReserved": "2025-12-08T00:00:00.000Z", "datePublished": "2026-03-11T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-11T16:11:36.236Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the \"tunnel\" parameter when killing a tunnel connection. Injected commands are executed with root privileges."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "http://lantronix.com"}, {"url": "http://eds5000.com"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:40:04.648802Z", "id": "CVE-2025-67037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:41:47.973Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-67037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-12T14:40:04.648802Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:41:40.316Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://lantronix.com"}, {"url": "http://eds5000.com"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the \"tunnel\" parameter when killing a tunnel connection. Injected commands are executed with root privileges."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-11T16:11:36.236Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67037", "state": "PUBLISHED", "dateUpdated": "2026-03-12T14:41:47.973Z", "dateReserved": "2025-12-08T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-11T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3:*:*:*:*:*:*", "matchCriteriaId": "7C529D16-1DCD-4189-8543-F68094F235B8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lantronix:eds5032:-:*:*:*:*:*:*:*", "matchCriteriaId": "04B4C755-3690-44B1-900A-71C5BEB4A1C0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3:*:*:*:*:*:*", "matchCriteriaId": "C9E5F912-430B-49D0-8E5A-B50B176DD50D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lantronix:eds5008:-:*:*:*:*:*:*:*", "matchCriteriaId": "B983DA3B-63DC-4981-A671-66A674234E80", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3:*:*:*:*:*:*", "matchCriteriaId": "4134547D-338A-4553-AAE7-5A2DFE374A20", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lantronix:eds5016:-:*:*:*:*:*:*:*", "matchCriteriaId": "86808903-C99D-4C74-A1D2-3E708B2074D8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the \"tunnel\" parameter when killing a tunnel connection. Injected commands are executed with root privileges."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad en Lantronix EDS5000 2.1.0.0R3. Un atacante autenticado puede inyectar comandos del sistema operativo en el par\u00e1metro 'tunnel' al finalizar una conexi\u00f3n de t\u00fanel. Los comandos inyectados se ejecutan con privilegios de root."}], "id": "CVE-2025-67037", "lastModified": "2026-03-19T20:13:48.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-11T17:16:51.900", "references": [{"source": "cve@mitre.org", "tags": ["Not Applicable"], "url": "http://eds5000.com"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "http://lantronix.com"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.1.0.0R3"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "eds5000", "vendor": "lantronix"}], "analysis": {"en": {"generated_at": "2026-03-19T21:28:56.323893+00:00", "value": {"mitigation_remediation": ["Check Lantronix for a firmware update that addresses this vulnerability; apply the update as soon as it is available.", "If no update is available, restrict network access to the device and enforce strong, least\u2011privilege authentication for management functions.", "Consider disabling the tunnel kill functionality if it is not needed for your operation.", "Monitor device logs for unexpected tunnel kill activity or suspicious command execution."], "summary": {"action": "Patch", "impact": "Command Injection with Root Privileges"}, "threat_synthesis": {"affected_systems": "Affected devices include Lantronix EDS5008, EDS5016, and EDS5032 models. All are vulnerable when running firmware version 2.1.0.0 r3, as indicated by the CPE entries and the recommendation that this specific firmware revision exhibits the flaw. No other versions are documented as affected in the provided data.", "description_and_impact": "An authenticated attacker can inject OS commands into the 'tunnel' parameter when terminating a tunnel on Lantronix EDS5000 devices running firmware 2.1.0.0 r3. This injection causes the commands to execute with root privileges, effectively granting the attacker full system control. The vulnerability is classified as Command Injection (CWE\u201194). With a CVSS score of 8.8, the defect presents high severity, allowing remote code execution that can compromise confidentiality, integrity, and availability.", "risk_and_exploitability": "The EPSS score is reported as less than 1%, suggesting a low likelihood of observed exploitation events, and the vulnerability is not listed in the CISA KEV catalog. However, the high CVSS score and the fact that the flaw requires authenticated access to a management function mean that an attacker who gains credentials could immediately exploit the device. The attack vector is likely through the device\u2019s management interface or any API that allows a user to terminate a tunnel connection. Since no workaround or patch is referenced in the data, the primary risk remains until a vendor update becomes available."}}}}, "created": "2026-03-12T10:06:37.975767+00:00", "title": "Authenticated Command Injection in Lantronix EDS5000 Firmware 2.1.0.0 R3 via Tunnel Kill Parameter", "updated": "2026-03-20T14:33:51.093602+00:00", "vendors": ["lantronix", "lantronix$PRODUCT$eds5000"]}