Description
The administrator password can be changed without knowledge of the current password. When chained with an authentication bypass vulnerability, this issue may allow unauthenticated attackers to modify the administrator password.
Affected products
lantronix: eds3016ps1ns firmware; lantronix: eds3016ps1ns; lantronix: eds3008ps1ns firmware; lantronix: eds3008ps1ns
References3
Metrics
- CVSS 3.1
-
2.7
LOW
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - CVSS 4.0
-
5.1
MEDIUM
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 46 · as of 12 November 2026
- CWE
- CWE-620CWE-78CWE-288
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.