Lantronix
11 CVEs across 28 Lantronix products. Browse Lantronix vulnerabilities, severities, and proof-of-concept exploits.
Lantronix products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-70082 | Critical | 9.8 | 2026-03-11 | An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component |
CVE-2025-67041 | Critical | 9.8 | 2026-03-11 | An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This… |
CVE-2025-67039 | Critical | 9.1 | 2026-03-11 | An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and… |
CVE-2025-67038 | Critical | 9.8 | 2026-03-11 | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The userna… |
CVE-2025-67037 | High | 8.8 | 2026-03-11 | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "tunnel" parameter when killing a tunnel conn… |
CVE-2025-67036 | High | 8.8 | 2026-03-11 | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitizatio… |
CVE-2025-67035 | Critical | 9.8 | 2026-03-11 | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The SSH Client and SSH Server pages are affected by multiple OS injection vulnerabilities due to missin… |
CVE-2025-67034 | High | 8.8 | 2026-03-11 | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credential… |
CVE-2025-7766 | High | 8.0 | 2025-07-22 | Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remo… |
CVE-2025-4338 | Medium | 6.8 | 2025-05-22 | Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain cre… |
CVE-2025-2567 | Critical | 9.8 | 2025-04-15 | An attacker could modify or disable settings, disrupt fuel monitoring and supply chain operations, leading to disabling of ATG monitoring. This would result… |
CVE-2023-7237 | Medium | 5.7 | 2024-01-23 | Lantronix XPort sends weakly encoded credentials within web request headers. |
CVE-2021-21896 | Medium | 6.5 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafte… |
CVE-2021-21895 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP… |
CVE-2021-21894 | Critical | 9.1 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP… |
CVE-2021-21892 | Critical | 9.9 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially cr… |
CVE-2021-21891 | Critical | 9.1 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speciall… |
CVE-2021-21890 | Critical | 9.1 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speciall… |
CVE-2021-21889 | Critical | 9.9 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted… |
CVE-2021-21888 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speci… |
CVE-2021-21887 | Critical | 9.1 | 2021-12-22 | A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A special… |
CVE-2021-21886 | Medium | 4.3 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FSBrowsePage functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially crafted HTTP requ… |
CVE-2021-21885 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially crafted HTTP request ca… |
CVE-2021-21884 | Critical | 9.1 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP… |
CVE-2021-21883 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HT… |
CVE-2021-21882 | High | 8.8 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque… |
CVE-2021-21881 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2021-21880 | High | 7.2 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reques… |
CVE-2021-21879 | High | 8.8 | 2021-12-22 | A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP reque… |
CVE-2021-21878 | Medium | 4.9 | 2021-12-22 | A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-cra… |
CVE-2021-21877 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger this vul… |
CVE-2021-21876 | Critical | 9.1 | 2021-12-22 | Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger this vulne… |
CVE-2021-21875 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigg… |
CVE-2021-21874 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21873 | Critical | 9.1 | 2021-12-22 | A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. An attacker can make an authenticated HTTP request to trig… |
CVE-2021-21872 | Critical | 9.9 | 2021-12-22 | An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-craf… |
CVE-2020-13528 | Medium | 5.3 | 2020-12-18 | An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4… |
CVE-2020-13527 | Medium | 4.5 | 2020-12-18 | An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 and 4.2.0.0R7. A speci… |
CVE-2018-10383 | Medium | 6.1 | 2019-05-02 | Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page. |
CVE-2018-12925 | Critical | 9.8 | 2018-06-28 | Baseon Lantronix MSS devices do not require a password for TELNET access. |
CVE-2016-4325 | Critical | 9.8 | 2016-05-14 | Lantronix xPrintServer devices with firmware before 5.0.1-65 have hardcoded credentials, which allows remote attackers to obtain root access via unspecified ve… |
CVE-2014-9003 | | 2014-11-20 | Cross-site request forgery (CSRF) vulnerability in Lantronix xPrintServer allows remote attackers to hijack the authentication of administrators for requests t… | |
CVE-2014-9002 | | 2014-11-20 | Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc act… | |
CVE-2008-7201 | | 2009-09-10 | Lantronix MSS485-T allows remote attackers to cause a denial of service (unstable performance and service loss) via certain vulnerability scans, as demonstrate… | |
CVE-2007-5981 | | 2007-11-15 | Lantronix SCS3200 does not properly handle public-key requests, which allows remote attackers to cause a denial of service (unresponsive device) via unspecifie… | |
CVE-2005-2189 | | 2005-07-11 | Lantronix SecureLinx console server running firmware 2.0 and 3.0 stores /etc/ssh under the web document root with insufficient access control, which allows rem… |