9.1

CVE-2025-67039

Medienbericht
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lantronix ≫ Eds3016ps1ns Firmware Version3.1.0.0 Updater2
   Lantronix ≫ Eds3016ps1ns Version-
Lantronix ≫ Eds3008ps1ns Firmware Version3.1.0.0 Updater2
   Lantronix ≫ Eds3008ps1ns Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.09% 0.254
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-288 Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02
Third Party Advisory
US Government Resource
http://eds3000ps.com
Not Applicable