CVE-2025-70082
Modified
Modified - Updated After Analysis
Arbitrary Code Execution in Lantronix EDS3000PS ltrx_evo Component
Vulnerability report for CVE-2025-70082, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-03-11
Last updated on: 2026-09-04
Assigner: MITRE
Description
Description
The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lantronix | eds3016ps1ns_firmware | 3.1.0.0r2 |
| lantronix | eds3008ps1ns_firmware | 3.1.0.0r2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
| CWE-620 | When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. |
