CVE-2025-67035: Lantronix EDS5000 RCE Vulnerability

CVE-2025-67035 Overview

CVE-2025-67035 is a critical OS command injection vulnerability affecting the Lantronix EDS5000 industrial device server. The vulnerability exists in the SSH Client and SSH Server web management pages, which fail to properly sanitize user-supplied input parameters. An attacker can exploit this flaw to inject arbitrary operating system commands through delete actions targeting server keys, users, and known hosts. Commands injected through this vulnerability execute with root privileges, providing complete system compromise.

Critical Impact

Unauthenticated attackers can execute arbitrary commands with root privileges on affected Lantronix EDS5000 devices, enabling full system compromise of industrial control infrastructure.

Affected Products

• Lantronix EDS5000 version 2.1.0.0R3
• Lantronix EDS5000 SSH Client management interface
• Lantronix EDS5000 SSH Server management interface

Discovery Timeline

• 2026-03-11 - CVE-2025-67035 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-67035

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), specifically manifesting as an OS command injection vulnerability. The SSH Client and SSH Server web management pages within the Lantronix EDS5000 fail to implement proper input validation and sanitization on user-controllable parameters. When administrators perform delete operations on objects such as server keys, users, or known hosts, the application passes these parameters directly to system shell commands without adequate filtering or escaping.

The network-accessible attack vector requires no authentication and no user interaction, making this vulnerability highly exploitable in production environments. Successful exploitation results in complete compromise of the device's confidentiality, integrity, and availability since injected commands execute with root-level privileges.

Root Cause

The root cause of CVE-2025-67035 is the absence of input sanitization in the web management interface's delete functionality. The application constructs shell commands using user-supplied input values for object identifiers (such as key names, usernames, or host entries) without properly escaping or validating these inputs against command injection patterns. This allows metacharacters and command separators to break out of the intended command context and execute attacker-controlled payloads.

Attack Vector

The attack is conducted over the network through the device's web management interface. An attacker targets the delete functionality in either the SSH Client or SSH Server configuration pages. By crafting malicious input containing shell metacharacters (such as semicolons, backticks, or command substitution syntax), the attacker can append or inject additional commands that execute alongside the legitimate delete operation. These injected commands inherit the execution context of the web server process, which operates with root privileges on the EDS5000 device.

The vulnerability enables attackers to read sensitive configuration files, modify device settings, establish persistent backdoors, pivot to other network segments, or disable the device entirely—all without requiring valid credentials.

Detection Methods for CVE-2025-67035

Indicators of Compromise

• Unexpected outbound network connections from EDS5000 devices to unknown external hosts
• Unauthorized modifications to SSH server keys, user accounts, or known hosts files
• Anomalous process execution or shell activity logged on the device
• Presence of unfamiliar files or scripts in system directories
• Web server access logs showing unusual parameters in delete action requests containing shell metacharacters

Detection Strategies

• Monitor HTTP request logs for the EDS5000 management interface, specifically watching for shell metacharacters (;, |, $(), backticks) in delete operation parameters
• Implement network intrusion detection rules to identify command injection patterns in traffic destined for EDS5000 devices
• Deploy endpoint detection solutions capable of identifying anomalous process spawning from web server processes
• Review authentication logs for unauthorized access attempts to the management interface

Monitoring Recommendations

• Enable verbose logging on EDS5000 devices and forward logs to a centralized SIEM for correlation
• Implement network segmentation to limit exposure of device management interfaces to trusted administrative networks only
• Configure alerting for any shell command execution patterns associated with the web management service
• Establish baseline behavior for EDS5000 devices and alert on deviations

How to Mitigate CVE-2025-67035

Immediate Actions Required

• Restrict network access to the EDS5000 web management interface using firewall rules or network ACLs
• Place affected devices behind a VPN or jump host requiring authentication before accessing management functions
• Disable the web management interface if not required for operations and use alternative management methods
• Conduct an audit of existing EDS5000 devices to identify any signs of prior compromise
• Review CISA's ICS Advisory ICSA-26-069-02 for additional guidance

Patch Information

Organizations should monitor Lantronix for security updates addressing this vulnerability. Review the Lantronix Security Resources page for firmware updates and security bulletins. Until a patch is available, apply the network isolation and access control workarounds described below.

Workarounds

• Implement strict network segmentation to isolate EDS5000 devices from untrusted networks
• Use a web application firewall (WAF) or reverse proxy with input validation rules to filter malicious requests
• Disable SSH Client and SSH Server management pages if the functionality is not required
• Require VPN access for all management interface connections
• Implement multi-factor authentication at the network perimeter for administrative access

# Example firewall rule to restrict management interface access
# Replace 10.0.0.0/24 with your trusted administrative network
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP