CVE-2025-67038 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-03-11

Added to CISA KEV: 2026-06-23 104 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review device logs, HTTP RPC access logs, and check for unauthorized configuration changes or unexpected processes/root shell activity
Immediately upgrade all affected devices to patched firmware versions: EDS5000 to 2.2.0.0R1+, G520/X300 to 2.6.0.4R6+, E210/E220 to 3.21.0.0R1+
Restrict network/internet access to device HTTP management interfaces; place devices behind VPN or firewall ACLs limiting access to trusted management networks only
Monitor network traffic and logs for anomalous authentication failure patterns or command injection attempts in username fields
Patch priority: URGENT/CRITICAL - apply patches immediately given confirmed active exploitation and KEV listing

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2025-67038 is a critical OS command injection vulnerability residing in the HTTP RPC module of the Lantronix EDS5000 device server (specifically version 2.1.0.0R3) ^[3]^[5]. The vulnerability occurs because the system fails to sanitize the username input before concatenating it into a shell command designed to log authentication failures, allowing an attacker to inject and execute arbitrary OS commands ^[5]. This is a significant issue because it grants attackers the ability to execute commands with root privileges, potentially compromising the integrity and security of the entire industrial device server ^[3].

Exploitation

Active Exploitation: The vulnerability is confirmed to be exploited in the wild, leading the Cybersecurity and Infrastructure Security Agency (CISA) to include it in their Known Exploited Vulnerabilities (KEV) Catalog ^[2]^[6].
Threat Actors/Campaigns: Specific threat actor groups have not been widely publicized by name, though the flaw is noted to specifically threaten industrial OT (Operational Technology) environments ^[1].
Proof-of-Concept/Exploit Tools: While technical details regarding the injection mechanism are publicly documented, specific ready-to-use exploit code availability remains a risk inherent to KEV-listed vulnerabilities ^[4].
Attack Prerequisites: This is a remote vulnerability that can be triggered over the network. While the trigger occurs during an authentication *failure*, it does not necessarily require a valid account, making it accessible to unauthenticated remote attackers ^[2]. No user interaction from a victim is required for successful exploitation.

Affected Products & Patches

Affected Versions: Lantronix EDS5000 firmware version 2.1.0.0R3 is explicitly confirmed as affected; similar issues have been identified in the G520, X300, E210, and E220 series ^[4].
Patches/Hotfixes: Lantronix has released security updates to address vulnerabilities in both the EDS3000PS and EDS5000 device servers ^[2]. Organizations should verify their current firmware versions against the manufacturer's security bulletins.
Mitigations: In environments where patching is not immediately feasible, organizations should restrict network access to the device server, particularly the web-based management interfaces (HTTP RPC), to trusted administrative networks only.

Impact

Access/Capability: Successful exploitation grants an attacker full remote code execution (RCE) capabilities with root-level privileges on the device ^[3].
Business Risk: For internet-facing deployments, this vulnerability presents an extreme risk. An attacker can achieve complete system compromise, enabling them to pivot into the internal network, intercept serial data, manipulate industrial processes, or establish persistent backdoors, which is particularly dangerous in critical OT and industrial infrastructure settings ^[1].

Sources

Cyber Intel Brief: CVE-2025-67038
CISA adds CVE-2025-67038, a critical flaw in Lantronix serial-to-ethernet converters to KEV, threatening industrial OT environments.
Exploitation of Critical Vulnerability in Lantronix Serial-to- ...
The US Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerability CVE-2025-67038 to its Known Exploited Vulnerabilities ( ... Lantronix has released security updates to address vulnerabilities in EDS3000PS and EDS5000 Device Servers. Successful exploitation of these vulnerabilit…
CVE-2025-67038: Lantronix EDS5000 RCE Vulnerability - SentinelOne
CVE-2025-67038 is a remote code execution vulnerability in Lantronix EDS5000 that allows attackers to execute arbitrary commands with root privileges. This article covers technical details, affected versions, and mitigation. ... CVE-2025-67038 is a remote code execution vulnerability in Lantronix ED…
CVE-2025-67038 - Vulnerability Details - OpenCVE
The vulnerability occurs in the HTTP RPC module of Lantronix EDS5000 firmware 2.1.0.0R3, where a command used to write logs on authentication failure is built by concatenating the supplied username directly into a shell command without sanitization. A comparable issue exists in the G520, X300, E210,…
NVD-CVE-2025-67038
CVE-2025-67038 Detail Description An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbit…

🔴 CVE-2025-67038