Lantronix EDS5000 OS Command Injection Vulnerability Allowing Root Privilege Execution

A vulnerability exists in the Lantronix EDS5000 version 2.1.0.0R3, where multiple OS injection vulnerabilities have been introduced due to inadequate input sanitization on the SSH Client and SSH Server pages. This flaw allows an attacker to inject arbitrary commands into delete actions for various objects, including server keys, users, and known hosts. The injected commands are executed with root privileges.

Impact

Exploitation of this vulnerability allows for authentication bypass and execution of injected commands with root-level privileges.