Filtered by vendor Lantronix Subscriptions
Total 44 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-67038 1 Lantronix 1 Eds5000 2026-03-13 9.8 Critical
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.
CVE-2025-67037 1 Lantronix 1 Eds5000 2026-03-13 8.8 High
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel connection. Injected commands are executed with root privileges.
CVE-2025-67036 1 Lantronix 1 Eds5000 2026-03-13 8.8 High
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
CVE-2025-67039 1 Lantronix 1 Eds3000ps 2026-03-13 9.1 Critical
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.
CVE-2025-67041 1 Lantronix 1 Eds3000ps 2026-03-13 9.8 Critical
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privileges.
CVE-2025-67035 1 Lantronix 1 Eds5000 2026-03-13 9.8 Critical
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missing sanitization of input parameters. An attacker can inject arbitrary commands in delete actions of various objects, such as server keys, users, and known hosts. Commands are executed with root privileges.
CVE-2025-70082 1 Lantronix 1 Eds3000ps 2026-03-13 9.8 Critical
An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component
CVE-2025-67034 1 Lantronix 1 Eds5000 2026-03-13 8.8 High
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.
CVE-2025-7766 1 Lantronix 1 Provisioning Manager 2025-07-25 8 High
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
CVE-2023-7237 1 Lantronix 2 Xport Edge, Xport Edge Firmware 2025-06-18 5.7 Medium
Lantronix XPort sends weakly encoded credentials within web request headers.
CVE-2014-9002 1 Lantronix 1 Xprintserver 2025-04-12 N/A
Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action.
CVE-2014-9003 1 Lantronix 1 Xprintserver 2025-04-12 N/A
Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests that modify configuration, as demonstrated by executing arbitrary commands using the c parameter in the rpc action.
CVE-2016-4325 1 Lantronix 1 Xprintserver Firmware 2025-04-12 N/A
Lantronix xPrintServer devices with firmware before 5.0.1-65 have hardcoded credentials, which allows remote attackers to obtain root access via unspecified vectors.
CVE-2008-7201 1 Lantronix 1 Mss485-t 2025-04-09 N/A
Lantronix MSS485-T allows remote attackers to cause a denial of service (unstable performance and service loss) via certain vulnerability scans, as demonstrated using (1) Nessus and (2) nmap.
CVE-2007-5981 1 Lantronix 1 Scs3200 2025-04-09 N/A
Lantronix SCS3200 does not properly handle public-key requests, which allows remote attackers to cause a denial of service (unresponsive device) via unspecified keyscan requests. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2005-2189 1 Lantronix 1 Securelinx 2025-04-03 N/A
Lantronix SecureLinx console server running firmware 2.0 and 3.0 stores /etc/ssh under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as SSH private keys.
CVE-2021-21896 1 Lantronix 2 Premierwave 2050, Premierwave 2050 Firmware 2024-11-21 6.5 Medium
A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to arbitrary file deletion. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2021-21895 1 Lantronix 2 Premierwave 2050, Premierwave 2050 Firmware 2024-11-21 7.2 High
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to FsTFtp file overwrite. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2021-21894 1 Lantronix 2 Premierwave 2050, Premierwave 2050 Firmware 2024-11-21 9.1 Critical
A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to arbitrary file overwrite FsTFtp file disclosure. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2021-21892 1 Lantronix 2 Premierwave 2050, Premierwave 2050 Firmware 2024-11-21 9.9 Critical
A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.