External risk intelligence

Lantronix EDS3000PS Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-67039

The affected product is a Lantronix device management system. Such management interfaces are commonly deployed as network-accessible appliances or gateways used for device configuration, making them frequently reachable in environments where administrators manage infrastructure remotely or across network segments.

Lantronix Eds3016ps1ns Firmware

3.1.0.0r2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An authentication bypass vulnerability has been identified in Lantronix device management products, specifically affecting certain management pages. This flaw could allow unauthorized access to device controls if exploited, potentially impacting the configuration and operation of connected systems. The primary concern is to confirm if these specific devices are in use within our environment.

Unauthorized access to device management.
Critical systems could be compromised.
Verify product presence and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on management pages by crafting a specific URL suffix and an Authorization header. This allows unauthorized access to sensitive management functions without needing legitimate credentials. The vulnerability can lead to significant compromise if exploited.

No authentication required for entry.
Triggered by URL manipulation and header.
Risk of unauthorized system access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication for management pages by manipulating URLs and sending a specific authorization header. When successful, this bypass could expose sensitive device configuration and management functions to unauthorized access.

Device management interface.
Unauthenticated URL manipulation.
Unauthorized administrative access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The most likely owners for this vulnerability are infrastructure or platform teams responsible for managing network-attached devices and their management interfaces. The first practical step is to identify all deployed Lantronix EDS3000PS devices, confirm their network exposure and criticality, and then coordinate with the appropriate vendor management or security teams to plan for remediation.

Infrastructure and platform teams own remediation.
Verify network exposure and device criticality.
Plan vendor engagement for firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Lantronix EDS3000PS?

The Lantronix EDS3000PS is a series of industrial device servers and terminal servers. These appliances function as communication gateways, allowing administrators to connect, manage, and monitor serial devices over an Ethernet network. They are commonly used in infrastructure environments to provide remote access to equipment that would otherwise lack network connectivity, acting as a central control point for connected industrial or enterprise hardware.

How does CVE-2025-67039 impact device security?

This vulnerability is classified as CWE-288, which refers to an authentication bypass weakness. It means the system's security controls, which are designed to verify identity before granting access, can be circumvented. In the context of CVE-2025-67039, an unauthorized party can gain entry to administrative management pages without providing a valid password, potentially allowing them to modify device settings or gain control over the system's operations.

Do I need to be logged in to trigger this vulnerability?

No. The flaw specifically allows an attacker to bypass the authentication process entirely. You do not need existing credentials or a prior session to trigger the bug. It is initiated by sending a specifically crafted request that includes a modified URL suffix and a particular Authorization header. Simply requesting a standard page or navigating the interface normally does not trigger this issue; it requires these specific, intentional manipulations.

Is my device at risk if it is not on the internet?

Halo Surface Signal indicates that management interfaces for these devices are frequently deployed in ways that make them reachable across network segments. While internet-facing devices are at the highest risk of discovery, devices accessible on internal networks may still be vulnerable to anyone with network access. You should treat the risk as elevated if the device management interface is reachable by any user or system outside of your trusted administrative group.

When should I take action for this CVE?

You should begin by verifying your internal inventory to locate any Lantronix EDS3000PS units within your environment. Once you have identified these systems, assess their network placement and the criticality of the hardware they manage. After identifying your assets, coordinate with your technical teams to engage the vendor for official guidance and firmware updates to resolve the authentication bypass.

References

www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.