CVE-2025-67039

Katalog CVE

CVSS 9.8 · Critical EPSS 0,46%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada lantronix eds3016ps1ns firmware, lantronix eds3008ps1ns firmware. Skor CVSS 3.1 9.8 (Critical) menurut hq.dhs.gov.

Deskripsi (NVD)

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

4 September 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber hq.dhs.gov
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 advisory pihak ketiga · pemerintah AS
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json
• https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-lib...