CVE-2025-70082: Lantronix EDS3000PS RCE Vulnerability

CVE-2025-70082 Overview

A critical command injection vulnerability has been identified in the Lantronix EDS3000PS industrial device server firmware version 3.1.0.0R2. The vulnerability exists within the ltrx_evo component and allows remote attackers to execute arbitrary code and obtain sensitive information without authentication. This flaw poses significant risk to industrial control system (ICS) environments where Lantronix EDS3000PS devices are deployed for serial-to-Ethernet connectivity.

Critical Impact

Remote attackers can exploit this vulnerability to achieve arbitrary code execution and access sensitive data on affected Lantronix EDS3000PS devices without requiring authentication, potentially compromising critical industrial infrastructure.

Affected Products

• Lantronix EDS3000PS firmware version 3.1.0.0R2
• Devices utilizing the vulnerable ltrx_evo component

Discovery Timeline

• 2026-03-11 - CVE-2025-70082 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-70082

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the ltrx_evo component of the Lantronix EDS3000PS device server, which fails to properly sanitize user-supplied input before passing it to system shell commands.

The vulnerability allows unauthenticated remote attackers to inject arbitrary operating system commands through network-accessible interfaces. Because the attack requires no privileges or user interaction and can be executed remotely over the network, it presents a severe threat to industrial environments where these devices manage critical serial communications infrastructure.

Successful exploitation enables attackers to execute commands with the privileges of the vulnerable service, potentially leading to complete device compromise, lateral movement within ICS networks, and exfiltration of sensitive operational data.

Root Cause

The root cause of this vulnerability is improper input validation in the ltrx_evo component. User-controlled data is incorporated into OS command strings without adequate sanitization or escaping of shell metacharacters. This allows attackers to break out of the intended command context and inject malicious commands that are then executed by the underlying operating system.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker with network access to the vulnerable Lantronix EDS3000PS device can craft malicious requests targeting the ltrx_evo component. By embedding shell metacharacters and commands within input fields, the attacker can achieve arbitrary command execution on the target device.

The vulnerability is particularly concerning in industrial environments where EDS3000PS devices may be accessible from operational technology (OT) networks or, in misconfigured deployments, directly from the internet. Attackers exploiting this flaw could manipulate device configurations, intercept serial communications, or use the compromised device as a pivot point for further attacks on connected industrial systems.

Detection Methods for CVE-2025-70082

Indicators of Compromise

• Unexpected outbound network connections from Lantronix EDS3000PS devices
• Anomalous process execution or shell activity on the device
• Unusual log entries indicating command injection patterns (e.g., semicolons, pipes, backticks in input fields)
• Changes to device configuration or firmware without authorized maintenance

Detection Strategies

• Monitor network traffic to and from Lantronix EDS3000PS devices for suspicious patterns or unexpected protocols
• Implement IDS/IPS rules to detect common command injection payloads targeting web interfaces and management ports
• Deploy network segmentation monitoring to detect lateral movement attempts from compromised devices
• Review device logs for authentication failures or unusual access patterns preceding potential exploitation

Monitoring Recommendations

• Enable comprehensive logging on Lantronix EDS3000PS devices and forward logs to a centralized SIEM
• Implement network flow analysis for all traffic involving industrial device servers
• Establish baseline behavior profiles for EDS3000PS devices to detect anomalous activity
• Configure alerts for any configuration changes or firmware updates on these devices

How to Mitigate CVE-2025-70082

Immediate Actions Required

• Isolate vulnerable Lantronix EDS3000PS devices from untrusted networks immediately
• Implement strict network segmentation to limit access to affected devices to authorized management systems only
• Apply firewall rules to restrict inbound connections to the ltrx_evo component from trusted IP addresses only
• Monitor affected devices for signs of compromise while awaiting a vendor patch

Patch Information

Organizations should consult the Lantronix Security Page for official patch availability and firmware update guidance. CISA has released an ICS advisory regarding this vulnerability; refer to CISA ICS Advisory ICSA-26-069-02 for additional mitigation guidance and remediation instructions from the coordinating authority.

Workarounds

• Place affected devices behind a firewall and restrict network access to essential management hosts only
• Disable any unnecessary network services on the EDS3000PS to reduce attack surface
• Implement VPN or other secure remote access methods if remote management is required
• Consider deploying an application-layer firewall or WAF to filter malicious input targeting the vulnerable component

Organizations should prioritize upgrading to a patched firmware version as soon as one becomes available from Lantronix. Until then, strict network isolation and monitoring remain the primary defensive measures for protecting vulnerable devices.