Read the docs
TI-2025-41111 Aliases CVE-2025-67037GHSA-w5v7-rqrc-ccv2

Lantronix EDS5000, G520, and X300 OS Command Injection

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00456 39th percentileScored 2026-11-07
Fix Fixed EDS5000 series (Lantronix): 2.2.0.0R1G520 series (Lantronix): 2.6.0.4R6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LantronixEDS5000 seriesup to 2.1.0.0R32.2.0.0R1Patch availableCNA
LantronixG520 seriesbefore 2.6.0.4R62.6.0.4R6Patch availableCNA
LantronixX300 seriesbefore 2.6.0.4R62.6.0.4R6Patch availableCNA
  • EDS5000 series VendorLantronix Affected up to 2.1.0.0R3 Fixed in 2.2.0.0R1 Patch available CNA
  • G520 series VendorLantronix Affected before 2.6.0.4R6 Fixed in 2.6.0.4R6 Patch available CNA
  • X300 series VendorLantronix Affected before 2.6.0.4R6 Fixed in 2.6.0.4R6 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3:*:*:*:*:*:*2.1.0.0 r3VulnerableLantronix
cpe:2.3:h:lantronix:eds5032:-:*:*:*:*:*:*:*not specified by NVDRunning onLantronix
cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3:*:*:*:*:*:*2.1.0.0 r3VulnerableLantronix
cpe:2.3:h:lantronix:eds5008:-:*:*:*:*:*:*:*not specified by NVDRunning onLantronix
cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3:*:*:*:*:*:*2.1.0.0 r3VulnerableLantronix
cpe:2.3:h:lantronix:eds5016:-:*:*:*:*:*:*:*not specified by NVDRunning onLantronix
  • cpe:2.3:o:lantronix:eds5032_firmware:2.1.0.0:r3:*:*:*:*:*:* Versions 2.1.0.0 r3 Vulnerable ·Lantronix
  • cpe:2.3:h:lantronix:eds5032:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lantronix
  • cpe:2.3:o:lantronix:eds5008_firmware:2.1.0.0:r3:*:*:*:*:*:* Versions 2.1.0.0 r3 Vulnerable ·Lantronix
  • cpe:2.3:h:lantronix:eds5008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lantronix
  • cpe:2.3:o:lantronix:eds5016_firmware:2.1.0.0:r3:*:*:*:*:*:* Versions 2.1.0.0 r3 Vulnerable ·Lantronix
  • cpe:2.3:h:lantronix:eds5016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lantronix

Remediation

  • Fix · CNA EDS5000 series (Lantronix) Fixed in 2.2.0.0R1
  • Fix · CNA G520 series (Lantronix) Fixed in 2.6.0.4R6
  • Fix · CNA X300 series (Lantronix) Fixed in 2.6.0.4R6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Lantronix G520 series, X300 series 2.6.0.4R6

    4 records Highest priority Priority CRITICAL 1 CRITICAL, 3 MEDIUM

    Other records, highest priority first

    • TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command InjectionPriority CRITICAL 99
    • TI-2025-41110 Lantronix EDS5000, G520, and X300 OS Command InjectionPriority MEDIUM 40
    • TI-2025-41108 Lantronix EDS5000, G520, and X300 OS Command InjectionPriority MEDIUM 40
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67037
  2. 2026-10-03 Alias added: GHSA-w5v7-rqrc-ccv2
  3. 2026-11-07 Priority changed: LOW → MEDIUM

References

Advisory 1

Other 2

  • TI-2025-41112 Lantronix EDS5000, G520, and X300 OS Command Injection KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-41109 Lantronix EDS5000 OS Command Injection CVSS 4.0HIGH 8.6
  • TI-2025-41110 Lantronix EDS5000, G520, and X300 OS Command Injection CVSS 4.0HIGH 8.6
  • TI-2025-41108 Lantronix EDS5000, G520, and X300 OS Command Injection CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences