CVE-2025-67034

high

Description

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

https://thehackernews.com/2026/04/22-bridgebreak-flaws-expose-20000.html

http://lantronix.com

http://eds5000.com

Details

Source: Mitre, NVD

Published: 2026-03-11

Updated: 2026-06-23

Named Vulnerability: BRIDGE:BREAK

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H