CVE-2025-67039: Lantronix EDS3008PS1NS Firmware

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.

Affected products

• Lantronix EDS3008PS1NS Firmware: version 3.1.0.0r2 only
• Lantronix EDS3016PS1NS Firmware: version 3.1.0.0r2 only

Published 2026-03-11. Last modified 2026-09-04.