Critical severity9.8NVD Advisory· Published Mar 11, 2026· Updated Sep 4, 2026

CVE-2025-67039

Description

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lantronix/Eds3008ps1ns Firmware
cpe:2.3:o:lantronix:eds3008ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*
Lantronix/Eds3016ps1ns Firmware
cpe:2.3:o:lantronix:eds3016ps1ns_firmware:3.1.0.0r2:*:*:*:*:*:*:*
Lantronix/EDS3000PScpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: =3.1.0.0R2

Patches

Vulnerability mechanics

References

www.cisa.gov/news-events/ics-advisories/icsa-26-069-02nvdThird Party AdvisoryUS Government Resource
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.jsonnvd
www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000