Lantronix EDS3000PS OS Command Injection

Why this deserves its current priority

CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Lantronix/EDS3000PS series (generic), n/a/n/a (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Lantronix/EDS3000PS series, n/a/n/a.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Mar 11, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 4, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jun 23, 2026

Sources and claim methodology

• GitHub security advisorygithub.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov
• Source referencelantronix.com
• Source referenceeds3000ps.com
• Source referencelantronix.com

Related CVEs

• wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')Also CWE-78
• CISA ADP VulnrichmentAlso CWE-78
• nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateSame generic ecosystem
• nebula-mesh: Operator session tokens stored in plaintext in the databaseSame generic ecosystem
• nebula-mesh: CA private key not zeroized on web mobile-bundle error pathsSame generic ecosystem
• Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCESame generic ecosystem