CVE-2025-67039 Unknown Vendor CVE debrief

Who should care

OT/ICS operators, plant engineers, and network defenders responsible for Lantronix EDS3000PS or EDS5000 deployments, especially where management interfaces are reachable from wider enterprise networks or any untrusted segment.

Technical summary

The CISA CSAF advisory states that authentication on management pages can be bypassed on Lantronix EDS3000PS 3.1.0.0R2 by combining a specific URL suffix with an Authorization header using the username "admin." The advisory rates the issue CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote exploitation with no prerequisites beyond network access. Remediation guidance in the corpus directs users of EDS3000PS to upgrade to version 3.2.0.0R2. The source corpus names EDS5000 in the advisory title and metadata, but the detailed vulnerability text and fix guidance are explicit for EDS3000PS.

Defensive priority

Immediate

Recommended defensive actions

• Upgrade Lantronix EDS3000PS to firmware version 3.2.0.0R2 per the vendor guidance in the CISA advisory.
• Confirm whether your EDS5000 deployments are covered by a separate vendor fix path or additional advisory before scheduling remediation.
• Restrict device management interfaces to trusted admin networks only; do not expose them directly to the internet or broad enterprise segments.
• Review device and network logs for suspicious management-page requests, unusual URL suffixes, and Authorization headers that attempt to authenticate as "admin."
• Validate configuration integrity on affected devices and look for unauthorized management changes after exposure.
• Apply CISA industrial control system recommended practices and defense-in-depth guidance for segmentation, monitoring, and access control.

Evidence notes

Source evidence comes from the CISA CSAF advisory ICSA-26-069-02, published 2026-03-10. The advisory description states: "An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses \"admin\" as the username." The advisory assigns CVSS v3.1 9.8 and lists the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Remediation in the corpus recommends upgrading EDS3000PS to 3.2.0.0R2. The source references and advisory title also include EDS5000, but the detailed vulnerability text provided is specific to EDS3000PS.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.