CVE-2025-67038
Lantronix EDS5000 Code Injection Vulnerability
Description
CVE-2025-67038 is a CRITICAL code injection vulnerability in the Lantronix EDS5000 family of serial-to-Ethernet device servers running firmware 2.1.0.0R3. The HTTP RPC module runs a shell command to write a log entry whenever authentication fails, and it concatenates the submitted username directly into that command without any sanitization, so an attacker can embed arbitrary OS commands in the username field. Because the failed-login path is reachable before any successful authentication, an unauthenticated remote attacker can trigger the flaw, and the injected commands execute with root privileges. Carrying a CVSS 3.1 score of 9.8, this code injection vulnerability gives full control of the affected device, and CVE-2025-67038 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, making the Lantronix EDS5000 command injection a high-priority security issue for any organization operating these device servers.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| lantronix | eds5032 firmware | 2.1.0.0r3 |
| lantronix | eds5008 firmware | 2.1.0.0r3 |
| lantronix | eds5016 firmware | 2.1.0.0r3 |
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2025-67038 stems from CWE-94, where the Lantronix EDS5000 constructs a shell command using externally-influenced input — the login username — without neutralizing special elements that alter the command's behavior. Because the failed-authentication logging routine concatenates the attacker-controlled username straight into a command that the device executes as root, an unauthenticated attacker can smuggle additional OS commands into the username parameter and have them run with full privileges.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2025-67038 carries a CVSS 3.1 score of 9.8 (CRITICAL) and is remotely exploitable over the network without physical access (Attack Vector NETWORK), easy to exploit with no special conditions (Attack Complexity LOW), requires no authentication (Privileges Required NONE), and needs no user interaction (User Interaction NONE). A successful exploit yields HIGH impact to confidentiality, integrity, and availability: because the injected commands run as root, an attacker can read any data on the device, alter its configuration and firmware behavior, pivot to attached serial equipment, and disable or brick the device server entirely. Although the scope is Unchanged, keeping the direct impact within the vulnerable component, these EDS5000 units frequently front industrial and operational-technology serial devices, so full root compromise of one unit can become a foothold into an otherwise segmented network. With CISA-confirmed active exploitation via the KEV listing and a trivially reachable unauthenticated attack path, organizations running affected Lantronix EDS5000 firmware should treat this vulnerability as an emergency.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-67038 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2026-06-26. The KEV ransomware status is currently listed as Unknown, but an unauthenticated remote-root flaw in an internet-facing device server is highly attractive to a broad range of threat actors. The EPSS score of 0.01094 places CVE-2025-67038 at roughly 1.1% probability, in the 61.5th percentile — a below-average raw likelihood that is nonetheless outweighed by the confirmed real-world exploitation the KEV listing represents. No dedicated public exploit or proof-of-concept is tagged in the available references (which comprise the CISA ICS advisory and the KEV catalog entry), but organizations should assume that working attack tooling exists and remediate immediately.
Remediation
- Follow the CISA KEV required action. Apply mitigations in accordance with Lantronix's instructions, ensuring compliance with CISA's BOD 26-04 guidance and Forensics Triage Requirements; follow the applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Evaluate each asset's internet exposure and meet the KEV remediation deadline of 2026-06-26. Consult the vendor and CISA guidance in the CISA ICS advisory ICSA-26-069-02.
- Update affected firmware. The EDS5008, EDS5016, and EDS5032 models are all affected on firmware 2.1.0.0R3; apply the fixed firmware release provided by Lantronix per the advisory, and inventory every EDS5000-series unit to confirm none remain on the vulnerable build.
- Remove the device from untrusted networks immediately. Until patched, take the HTTP management interface off the public internet, restrict it to a dedicated management VLAN, and enforce firewall/ACL rules so only trusted administrative hosts can reach the RPC endpoint — this closes the unauthenticated remote attack path.
- Hunt for prior exploitation. Review device and upstream logs for anomalous failed-login attempts containing shell metacharacters (
;,|,`,$()) in the username field, unexpected outbound connections, and unauthorized configuration or firmware changes, given the confirmed in-the-wild exploitation. - Harden against code injection long-term. Where configurable, disable or restrict unused management services, and prioritize firmware releases in which Lantronix validates and neutralizes user input before it is ever passed to a shell — the root fix for CWE-94 code injection is to stop building executable commands from untrusted input.
Technical Details
CVE-2025-67038 is a code injection vulnerability (CWE-94) in the HTTP RPC module of the Lantronix EDS5000 device server, and it maps to the classic pattern where software builds part of an executed command from externally-influenced input without neutralizing special elements. When a login attempt fails, the module invokes a shell command to write a log entry and inserts the attacker-supplied username into that command string verbatim; a username such as one containing a command separator followed by an arbitrary command is therefore parsed and executed by the shell rather than treated as literal text. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that the attack is delivered over the network, is low-complexity, requires neither privileges nor user interaction, and results in full HIGH impact to confidentiality, integrity, and availability — precisely because the injected commands run as root. This weakness is among the most severe classes in embedded and networking devices, since a single unsanitized field in an authentication routine becomes an unauthenticated remote-root primitive.
Frequently Asked Questions
Is CVE-2025-67038 being actively exploited?
Yes. CVE-2025-67038 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation deadline of 2026-06-26. Its EPSS score of 0.01094 (61.5th percentile) reflects a modest raw probability, but the KEV listing means real-world attacks against the Lantronix EDS5000 have been observed. Ransomware involvement is currently listed as Unknown.
What products are affected by CVE-2025-67038?
The vulnerability affects the Lantronix EDS5000 family of device servers on firmware 2.1.0.0R3, specifically the EDS5008, EDS5016, and EDS5032 models. Organizations should inventory every EDS5000-series unit and confirm the running firmware version. All units on the affected build expose the unauthenticated command injection.
How do I fix CVE-2025-67038?
Follow CISA's KEV required action, apply the fixed firmware from Lantronix per ICS advisory ICSA-26-069-02, and — if a fix is not yet available — discontinue exposure of the device. While remediating, remove the HTTP management interface from untrusted networks, restrict it to trusted administrative hosts, and review logs for signs of prior exploitation as described in the Remediation section.
How severe is CVE-2025-67038?
CVE-2025-67038 is rated CRITICAL with a CVSS 3.1 score of 9.8. It allows an unauthenticated remote attacker to execute arbitrary OS commands as root with low attack complexity and no user interaction, achieving HIGH impact to confidentiality, integrity, and availability. Its inclusion in the KEV catalog makes it a top-priority vulnerability for immediate remediation despite its moderate EPSS percentile.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.