CVE-2025-67041: Lantronix EDS3000PS RCE Vulnerability

CVE-2025-67041 Overview

A critical command injection vulnerability has been discovered in the Lantronix EDS3000PS device server firmware version 3.1.0.0R2. The vulnerability exists within the TFTP client functionality accessible through the Filesystem Browser page. The host parameter fails to properly sanitize user input, allowing attackers to escape from the intended command context and execute arbitrary commands with root-level privileges on the affected device.

This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The network-accessible nature of this flaw combined with the lack of authentication requirements makes it particularly dangerous for industrial and enterprise environments where these device servers are deployed.

Critical Impact

Remote unauthenticated attackers can achieve complete system compromise with root privileges on Lantronix EDS3000PS devices by exploiting improper input sanitization in the TFTP client host parameter.

Affected Products

• Lantronix EDS3000PS firmware version 3.1.0.0R2
• Earlier versions of Lantronix EDS3000PS may also be affected

Discovery Timeline

• 2026-03-11 - CVE-2025-67041 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-67041

Vulnerability Analysis

The vulnerability resides in the web-based management interface of the Lantronix EDS3000PS device server. Specifically, the Filesystem Browser page includes TFTP client functionality that allows users to specify a remote host for file transfers. The host parameter passed to this function is not properly validated or sanitized before being incorporated into system commands executed on the underlying operating system.

When a user supplies a crafted value for the host parameter, the application constructs an OS command that includes this untrusted input. Due to insufficient input validation, an attacker can inject shell metacharacters (such as semicolons, pipes, or backticks) to break out of the intended command structure and append additional arbitrary commands. These injected commands execute with the same privilege level as the web application process—in this case, root privileges—providing complete control over the device.

The attack can be executed remotely over the network without any prior authentication, making this vulnerability particularly severe. An attacker with network access to the device's management interface can fully compromise the system, potentially leading to data exfiltration, persistent backdoor installation, lateral movement within the network, or disruption of industrial control systems that rely on this device server for serial-to-Ethernet connectivity.

Root Cause

The root cause of this vulnerability is the failure to implement proper input validation and output encoding for the host parameter in the TFTP client functionality. The application directly passes user-controlled input to shell command execution functions without:

1. Validating that the input conforms to expected hostname or IP address formats
2. Sanitizing or escaping special shell metacharacters
3. Using parameterized command execution methods that prevent injection

This allows command separator characters and shell operators to be interpreted by the underlying shell, enabling command injection attacks.

Attack Vector

The attack is conducted over the network against the web management interface of the Lantronix EDS3000PS. An attacker can access the Filesystem Browser page and manipulate the TFTP client's host parameter to include malicious command sequences.

For example, an attacker could inject a value containing shell metacharacters followed by arbitrary commands. When the application processes this input, the injected commands are executed with root privileges on the device. The attack requires no authentication and can be performed by anyone with network access to the management interface.

The exploitation mechanism involves:

1. Accessing the Filesystem Browser page on the device's web interface
2. Locating the TFTP client functionality
3. Injecting malicious payload into the host parameter field
4. Submitting the request, which triggers command execution on the server

For detailed technical information, refer to the CISA ICS Advisory ICSA-26-069-02.

Detection Methods for CVE-2025-67041

Indicators of Compromise

• Unusual HTTP requests to the Filesystem Browser page containing shell metacharacters (;, |, `, $()) in the host parameter
• Unexpected processes spawned by the web server process on the device
• Network connections originating from the device to unknown external IP addresses
• Unauthorized configuration changes or new user accounts on the device
• Log entries showing TFTP operations with malformed or suspicious host values

Detection Strategies

• Implement network intrusion detection rules to identify HTTP requests to the EDS3000PS management interface containing command injection patterns
• Monitor web server logs for requests to the Filesystem Browser page with suspicious parameter values
• Deploy application-layer firewalls or WAF rules to block requests containing shell metacharacters in TFTP-related parameters
• Conduct regular vulnerability scans of Lantronix devices to identify unpatched firmware versions

Monitoring Recommendations

• Enable detailed logging on Lantronix EDS3000PS devices and forward logs to a centralized SIEM solution
• Establish baseline behavior for device network communications and alert on deviations
• Monitor for any unauthorized firmware modifications or configuration changes
• Implement network segmentation to isolate industrial device servers and restrict access to management interfaces

How to Mitigate CVE-2025-67041

Immediate Actions Required

• Restrict network access to the Lantronix EDS3000PS management interface using firewall rules or network segmentation
• Place affected devices behind a VPN and require authentication before accessing the management interface
• Audit device logs for any signs of exploitation attempts
• Disable the TFTP client functionality if not operationally required
• Contact Lantronix for updated firmware that addresses this vulnerability

Patch Information

At the time of publication, users should check the Lantronix Homepage and the EDS3000PS Homepage for firmware updates that address this vulnerability. Additionally, review the CISA ICS Advisory ICSA-26-069-02 for official mitigation guidance and patch availability information.

Workarounds

• Implement strict network access controls to limit who can reach the device management interface
• Use a web application firewall to filter requests containing command injection patterns
• Disable web-based management and use alternative management methods if available
• Monitor device behavior closely for any indicators of compromise until a patch is applied

# Example firewall rule to restrict access to EDS3000PS management interface
# Allow only trusted management subnet to access the device
iptables -A INPUT -p tcp --dport 80 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP