Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SGX5150",
          "vendor": "Lantronix",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Lantronix\nSGX5150, firmware 9.13.0.0R7, an IT/OT device server.\n\nType: authenticated OS command injection (CWE-78) in the FsBrowseClean AJAX\nhandler (0x5eea0) of /bin/ltrx_evo. A per-character filter blocks \u0026 | \u003c ; ! $\nbackslash backtick and \u003e but permits single quote, hash and newline. The path\nPOST parameter is concatenated into /sbin/ltrx_usb_umount \u0027%s\u0027 and run through\n/bin/sh -c as root. Sending path=x\u0027%0a\u003ccmd\u003e%20%23 closes the quoted argument,\nopens a new shell line carrying the attacker\u0027s command, and comments out the\ntrailing quote. The sink is blind.\n\nScoring. This finding is dual-scored, and the conditional figure is NOT\nverified, which is stated rather than glossed:\n- PRIMARY, adopted, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.\n  PR:H rests on a genuine privileged web session being required.\n- CONDITIONAL, NOT verified, 9.8 Critical,\n  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Applies only if the device\n  serial number is obtainable, which would make the factory administrator\n  password (recorded as serial-derived) no secret and the chain effectively\n  unauthenticated. Serial recovery was NOT verified, and neither was the\n  derivation itself.\n- SEPARATE secondary defect, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reachable only where Digest \nauthentication is configured: the\n  Digest username extractor at 0xff838 verifies no nonce, realm or response, so a\n  forged Authorization: Digest username=\"admin\" header alone sets the identity to\n  admin. This is independent of, and not additive to, the primary finding.\n\nScoring note. The research record attached 8.8 to the PR:H vector. That vector\ncomputes to 7.2, not 8.8 under CVSS 3.1; this advisory recomputes from the vector\nprinted beside it and reports 7.2, keeping 8.8 only as a labelled PR:L\nhypothetical (no lower-privileged account passing the filesystem write test was\nenumerated, so it is not claimed).\n\nImpact: root execution on an industrial gateway (ltrx_evo runs as root), giving\nfull read of configuration and serial traffic, arbitrary root modification,\npersistent implantation, total availability loss and a pivot into segmented\nnetworks.\n\nAuthentication: an authenticated web session satisfying\nIsGroupListWritable(identity, \"filesystem\"); the session precondition is static\nanalysis, not dynamically verified.\n\nVerification boundary, stated plainly. No physical SGX5150 hardware was used at\nany point; verification is sink-faithful rather than full-stack. The character\nfilter, the IseUSB gate and the sink construction were replicated in a chroot of\nthe extracted ARM rootfs under qemu-arm-static, and the injected newline vector\npassed the product\u0027s own filter and ran as root via the product\u0027s own /bin/sh and\nmarker owned by root:root. End-to-end HTTP against a live daemon was not\nachievable, because ltrx_evo requires NVRAM state, the encrypted factory.xcr\ndevice-serial material and a ZMQ IPC stack that could not be reconstructed\noutside the device.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/lantronix-sgx5150-fsbrowseclean-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/74"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/74"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/lantronix-sgx5150-fsbrowseclean-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/74"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Lantronix SGX5150 9.13.0.0R7 Authenticated FsBrowseClean command injection to root RCE (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0426",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/74",
            "automated": true,
            "contentSha256": "d6670722639ae6e018f6457e300ad3ae04f054ec188213319fd7740f05872762",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/74",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:54:13Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0426"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "EDS3000PR",
          "vendor": "Lantronix",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantronix EDS3000PR 3.2.0.0R2.\n\nVulnerability 1 \u2014 Authenticated command injection to root RCE in FsUnmount (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nLantronix EDS3000PR is an industrial serial device server (CII/OT). Its FsUnmount page handler validates a \nuser-supplied path against a character bitmask that rejects most shell metacharacters but allows single quotes and \nnewlines, then executes /sbin/ltrx_usb_umount \u0027/ltrx_user\u003cpath\u003e\u0027 via /bin/sh -c. A newline breaks out of the \nsingle-quoted command and the injected command executes as root. Verified with a root-owned marker in a qemu-arm chroot \nusing the real rootfs /bin/sh.\n\nAuthentication: authenticated (requires valid session)\n\nVulnerability 2 \u2014 Authenticated command injection to root RCE in SSL certificate import and diagnostics (CVSS 8.8, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78)\n\nOn the same Lantronix EDS3000PR device, the SSL certificate upload handler builds openssl rsa|dsa|ec|pkcs12 -passin \npass:%s commands from the attacker-controlled certificate password and executes them via system(); the diagnostics \nhandler builds ping and traceroute commands from the attacker-controlled host field the same way. No shell-character \nsanitization exists. An authenticated admin submits a semicolon or command-substitution payload in the password or host \nfield; the injected command executes as root. Verified with root markers for 5/5 SSL vectors and 3/3 diagnostics \nvectors.\n\nAuthentication: authenticated (requires valid session)\n\nFull technical analyses and reproducible proofs-of-concept:\n  https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection\n  https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE IDs are pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:56:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/6"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-fsunmount-command-injection"
        },
        {
          "url": "https://0day-rubbish.com/blog/lantronix-eds3000pr-passin-pass-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Lantronix EDS3000PR 3.2.0.0R2 two vulnerabilities",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0165",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/6",
            "automated": true,
            "contentSha256": "06ba7fc5d15136ee62ee34cb74db1c10b234c3b66a7cb5d42fb6f500d9dc4431",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:10:49Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-11T11:56:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0165"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}