CVE-2025-67039

Published: Mar 11, 2026Modified: Jul 5, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

Affected (2)

Products: Lantronix: Eds3016ps1ns Firmware, Eds3008ps1ns Firmware

Lantronix

2 products

Eds3016ps1ns Firmware

Eds3008ps1ns Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lantronix Eds3016ps1ns Firmware	Version 3.1.0.0r2

Running on/with	Platform Versions
Lantronix Eds3016ps1ns	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lantronix Eds3008ps1ns Firmware	Version 3.1.0.0r2

Running on/with	Platform Versions
Lantronix Eds3008ps1ns	All versions

Related CWEs

CWE-288

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (1)

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.