CVE-2025-67038
Description
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
Summary dbcve.org
The Lantronix EDS5000 device running HTTP RPC module version 2.1.0.0R3 contains a critical OS command injection vulnerability. When user authentication fails, the system logs the username by directly concatenating it into a shell command without any input sanitization or validation. Attackers can inject arbitrary shell commands through the username parameter, which execute with root privileges due to the logging functionality running with elevated permissions.
Mitigation
Apply vendor-supplied firmware patch when available; until then, disable or restrict access to the HTTP RPC module, implement network segmentation to limit exposure, and deploy WAF/IPS rules to detect and block command injection attempts.