{"id":"CVE-2025-67038","kind":"vulnerability","aliases":["CVE-2025-67038"],"related":[],"title":"An issue was discovered in Lantronix EDS5000 2.1.0.0R3","description":"Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"The Lantronix EDS5000 device-server has a code injection flaw in its username parameter that lets an attacker inject OS commands. Injected commands run with root privileges, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-06-23T00:00:00+00:00","products":[{"name":"Lantronix EDS5000","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"lantronix eds5008 firmware","fixed":["2.2.0.0r1"],"affected":"< 2.2.0.0r1","ecosystem":"vendor"},{"name":"lantronix eds5016 firmware","fixed":["2.2.0.0r1"],"affected":"< 2.2.0.0r1","ecosystem":"vendor"},{"name":"lantronix eds5032 firmware","fixed":["2.2.0.0r1"],"affected":"< 2.2.0.0r1","ecosystem":"vendor"},{"name":"lantronix g526gp12s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g526gp17s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g526gp1cs firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g526gp1asg firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g526gp1as firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g527gp22s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g527gp27s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g527gp2as firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g527gp2asg firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g528gp2fs firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g528gp2fsg firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix g528gp2fsgc firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix x300f202s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix x303f202s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix x304g00as firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix x304g000s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix x304g002s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix x304g007s firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix x304g00cs firmware","fixed":["2.6.0.4R6"],"affected":"< 2.6.0.4R6","ecosystem":"vendor"},{"name":"lantronix e228g002s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e228g004s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e228g00cb28 firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e228g00cs firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e213f102s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e214f002s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e214f00cs firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e214g000s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e214g001s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e218f004s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"},{"name":"lantronix e218g107s firmware","fixed":["3.21.0.0R1"],"affected":"< 3.21.0.0R1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["eds5000","exploited","industrial-iot","infrastructure","lantronix","serial-to-ethernet"],"not_affected_if":["no-eds5000-deployed"],"how_to_check":"Check whether any EDS5000 units are in your inventory and which firmware version they run; the sources do not give a command or file to check the version.","fix":"Apply the vendor mitigation or patch per Lantronix instructions; the sources do not name a fixed version.\nIf no mitigation is available, discontinue use of the device as CISA directs.","status":"open","published_at":"2026-03-11T17:16:52+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:50+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:33:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch per Lantronix instructions; the sources do not name a fixed version.\nIf no mitigation is available, discontinue use of the device as CISA directs.","summary":"The Lantronix EDS5000 device-server has a code injection flaw in its username parameter that lets an attacker inject OS commands. Injected commands run with root privileges, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["lantronix","eds5000","industrial-iot","serial-to-ethernet"],"confidence":0.7,"analyst_note":"Find the vendor advisory from Lantronix and the affected/fixed firmware versions, plus whether the username injection is pre-auth; see the CISA KEV entry and BOD 26-04 notes.","how_to_check":"Check whether any EDS5000 units are in your inventory and which firmware version they run; the sources do not give a command or file to check the version.\nUnknown whether the login username field is reachable from your network; review which networks can reach the device's web or management interface.\nUnknown for log indicators; the sources do not say what exploitation looks like in logs.","needs_analyst":true,"not_affected_if":["no-eds5000-deployed"],"severity_if_unknown":"critical"},"cost_usd":0.000437,"input_tokens":2206,"output_tokens":433,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':207C,233C,264C '-2025':11A,14A '-67038':12A,15A '2.1.0.0':8A '26':206C,232C,263C 'accord':196C 'action':192C 'activ':161B 'adher':260C 'allow':172C 'appli':193C 'applic':230C 'arbitrari':176C 'asset':254C 'attack':146B,173C 'base':211C 'bod':205C,231C,262C 'cisa':157B,190C,203C,220C 'cloud':236C 'code':136B,167C 'command':149B,151B,178C,184C 'complianc':201C 'contain':165C 'could':171C 'cve':10A,13A 'devic':132B 'device-serv':131B 'discontinu':239C 'discov':4A 'e213f102s':97A 'e214f002s':100A 'e214f00cs':103A 'e214g000s':106A 'e214g001s':109A 'e218f004s':112A 'e218g107s':115A 'e228g002s':85A 'e228g004s':88A 'e228g00cb28':91A 'e228g00cs':94A 'eds5000':7A,17A,117B,130B,164C 'eds5008':19A 'eds5016':22A 'eds5032':25A 'ensur':200C,259C 'ethernet':127B 'evalu':252C 'execut':186C 'exploit':118B,162B 'exposur':257C 'firmware':20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,104A,107A,110A,113A,116A 'flaw':138B 'follow':229C 'forens':222C 'g526gp12s':28A 'g526gp17s':31A 'g526gp1as':40A 'g526gp1asg':37A 'g526gp1cs':34A 'g527gp22s':43A 'g527gp27s':46A 'g527gp2as':49A 'g527gp2asg':52A 'g528gp2fs':55A 'g528gp2fsg':58A 'g528gp2fsgc':61A 'guidanc':218C,234C 'guidelin':266C 'industri':120B 'industrial-iot':119B 'infrastructur':122B 'inject':137B,147B,150B,168C,175C,183C 'instruct':199C 'internet':256C 'iot':121B 'issu':2A 'lantronix':6A,16A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,102A,105A,108A,111A,114A,123B,129B,163C 'let':144B 'list':158B 'mitig':194C,245C 'note':217C,228C 'os':148B,177C 'paramet':142B,182C 'patch':265C 'priorit':208C 'privileg':155B,189C 'product':243C 'r3':9A 'requir':191C,224C 'respons':250C 'risk':213C 'root':154B,188C 'run':152B 'secur':209C 'see':214C,225C 'serial':125B 'serial-to-ethernet':124B 'server':133B 'servic':237C 'stakehold':248C 'triag':223C 'unavail':247C 'updat':210C 'url':215C,226C 'use':240C 'usernam':141B,181C 'vendor':198C 'vulner':169C 'x300f202s':64A 'x303f202s':67A 'x304g000s':73A 'x304g002s':76A 'x304g007s':79A 'x304g00as':70A 'x304g00cs':82A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-11T17:16:52+00:00","kev":{"dateAdded":"2026-06-23","dueDate":"2026-06-26","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-67038","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-67038","severity":null,"published_at":"2026-06-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-67038","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67038","severity":null,"published_at":"2026-03-11T17:16:52+00:00","modified_at":"2026-09-08T19:00:57+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}