CVE-2025-67041

The vulnerability results from improper sanitization of the TFTP client host parameter available on the Filesystem Browser page in the device management interface. An attacker can provide a crafted parameter value that allows escaping from the originally intended command and injection of their own arbitrary system command. The injected command is executed with root privileges, giving full control over the device. The flaw is compounded by missing authentication mechanism (CWE-288) and improper verification of authentication credentials (CWE-620).

An attacker without any privileges can remotely execute arbitrary system commands with root level access over the network, which means complete takeover of the device, ability to read and modify configuration, and potential use of the device as an entry point to the further network.

Patches available from the manufacturer should be applied according to the references. It is also recommended to restrict access to the device management interface only to trusted hosts or management networks and, until the patch is installed, to disable or restrict access to the Filesystem Browser functionality. Detailed recommendations are available in the ICS-CERT message: ICSA-26-069-02.

Lantronix EDS3016PS1NS Firmware, Lantronix EDS3008PS1NS Firmware and corresponding hardware devices; vulnerability confirmed in firmware version 3.1.0.0R2