CVE-2025-67039
critical · 9.3An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.
9.3
CVSS
0.4%
EPSS (exploit prob.)
38th
EPSS percentile
2026-03-11
Published
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-288
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| lantronix | eds3016ps1ns_firmware | 3.1.0.0r2 |
| lantronix | eds3016ps1ns | all versions |
| lantronix | eds3008ps1ns_firmware | 3.1.0.0r2 |
| lantronix | eds3008ps1ns | all versions |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
- https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2025-67039