How do I check whether I am affected by CVE-2025-67038?

Check whether any EDS5000 units are in your inventory and which firmware version they run; the sources do not give a command or file to check the version.

What is the fix for CVE-2025-67038?

Apply the vendor mitigation or patch per Lantronix instructions; the sources do not name a fixed version. If no mitigation is available, discontinue use of the device as CISA directs.

Who is not affected by CVE-2025-67038?

Not affected if: no-eds5000-deployed.

Live › vulnerability › CVE-2025-67038

Go to dashboard

critical9.8Exploited in the wildInfrastructure

An issue was discovered in Lantronix EDS5000 2.1.0.0R3

The Lantronix EDS5000 device-server has a code injection flaw in its username parameter that lets an attacker inject OS commands. Injected commands run with root privileges, and CISA lists it as actively exploited.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Mar 11, 2026 UTC
Last modified: Sep 8, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.

Known exploitation

CISA KEV

Added to KEV: Jun 23, 2026
Patch due: Jun 26, 2026 (passed)
Ransomware use: Unknown

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Who is affected

34 products

Product	Ecosystem	Affected	Fixed in
Lantronix EDS5000	vendor	–	–
lantronix eds5008 firmware	vendor	< 2.2.0.0r1	2.2.0.0r1
lantronix eds5016 firmware	vendor	< 2.2.0.0r1	2.2.0.0r1
lantronix eds5032 firmware	vendor	< 2.2.0.0r1	2.2.0.0r1

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2025-67038

Go to dashboard

critical9.8Exploited in the wildInfrastructure

An issue was discovered in Lantronix EDS5000 2.1.0.0R3

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far5 of 6

missing: primary source

First public: Mar 11, 2026 UTC
Last modified: Sep 8, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.

Known exploitation

CISA KEV

Added to KEV: Jun 23, 2026
Patch due: Jun 26, 2026 (passed)
Ransomware use: Unknown

Who is affected

34 products

Product	Ecosystem	Affected	Fixed in
Lantronix EDS5000	vendor	–	–
lantronix eds5008 firmware	vendor	< 2.2.0.0r1	2.2.0.0r1
lantronix eds5016 firmware	vendor	< 2.2.0.0r1	2.2.0.0r1
lantronix eds5032 firmware	vendor	< 2.2.0.0r1	2.2.0.0r1

Know the next one before it finds you.

Add to Slack

An issue was discovered in Lantronix EDS5000 2.1.0.0R3

Known exploitation

Who is affected

Know the next one before it finds you.

An issue was discovered in Lantronix EDS5000 2.1.0.0R3

Known exploitation

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources