CVE-2025-67038

What it actually does

This is an unauthenticated network-reachable OS command injection vulnerability in the Lantronix EDS5000 HTTP RPC authentication failure path. When authentication fails, the device builds a shell command to write logs and directly concatenates the supplied username without sanitization. An attacker can place shell metacharacters or command substitutions in the username value and cause arbitrary commands to execute as root on the appliance, enabling full device compromise, configuration theft or modification, service disruption, persistence, and potential pivoting into connected operational networks.

Why it matters to the business

Successful exploitation can give an external attacker complete administrative control of affected Lantronix EDS5000 serial device servers, which may disrupt connected industrial, facilities, telecom, or remote management workflows. Because the issue is unauthenticated, low complexity, actively exploited in the wild, and listed in CISA KEV with a remediation deadline of 2026-06-26, exposed devices should be treated as high-priority remediation targets even if exploitation has not yet been confirmed. Compromise may result in outages, tampering with serial-connected equipment, credential exposure, unauthorized remote access, and use of the device as a foothold for broader intrusion.

How an attack unfolds

An attacker first identifies an exposed Lantronix EDS5000 management interface and sends an HTTP RPC authentication request designed to fail. Instead of using a normal username, the attacker supplies a username containing shell control characters such as semicolons, pipes, backticks, or command substitution syntax. The vulnerable firmware passes that unsanitized username into a shell command used for logging the failed authentication event. The operating system interprets the injected content as commands and executes them with root privileges. From there, the attacker can run reconnaissance commands, download tools or malware, alter configuration, create persistence, disable services, exfiltrate data, or pivot to systems reachable from the device. Public exposure substantially increases risk because no valid credentials or user interaction are required.

How to fix it

Upgrade affected Lantronix EDS5000 devices to a vendor-provided fixed firmware version as soon as one is available. The provided input does not list specific fixed versions, so administrators should consult Lantronix security advisories and support channels for the corrected firmware for EDS5008, EDS5016, and EDS5032 devices. Until patched, remove internet exposure, restrict HTTP/RPC management access to a dedicated administrative network or VPN, enforce firewall allowlists for trusted management hosts only, disable unnecessary management services, and monitor for suspicious authentication attempts. If exploitation is suspected, treat the device as compromised: isolate it, preserve logs and configuration, reflash with trusted firmware, rotate credentials and secrets that may have traversed or been stored on the device, and review adjacent systems for lateral movement.

How to confirm the fix worked

Confirm whether each device is an affected Lantronix EDS5000 model, including EDS5008, EDS5016, or EDS5032, and record the installed firmware version. Validate that the deployed firmware is newer than the vulnerable 2.1.0.0R3 release or matches the vendor-declared fixed release when available. From a trusted test network, verify that management interfaces are not reachable from untrusted networks and that firewall rules restrict access to approved administrative sources. After remediation, send benign failed-login test values containing shell metacharacters in the username field and confirm they are rejected, escaped, or logged as inert text without command execution or unexpected outbound network activity. Review device logs, network telemetry, and configuration backups to ensure no unauthorized users, startup commands, altered settings, or unknown outbound destinations remain.

Typical attack path

1. Scan for Lantronix EDS5000 devices with reachable HTTP management or RPC interfaces.
2. Confirm the target appears to be an affected EDS5000 model or firmware generation.
3. Send an HTTP authentication/RPC request with a deliberately invalid login so the failure logging path is reached.
4. Place shell metacharacters or command substitution in the username parameter.
5. Cause the device to execute injected commands as root while processing the failed authentication log entry.
6. Run discovery commands such as id, uname, ifconfig/ip, route, ps, or netstat to understand the device and network position.
7. Download or stage additional payloads using built-in tools such as wget, curl, tftp, ftp, or nc if available.
8. Modify device configuration, add persistence, disrupt services, harvest secrets, or use the appliance as a pivot into reachable networks.

How to detect it

Look for evidence of malicious failed-login attempts and post-exploitation behavior on device logs, web access logs, firewall/proxy logs, NetFlow, packet captures, and any centralized syslog that receives Lantronix events. Prioritize HTTP requests to management or RPC authentication endpoints where the username parameter contains shell metacharacters, URL-encoded separators, command substitution, or common execution and download utilities. Review authentication failure logs for usernames containing characters such as semicolon, pipe, ampersand, backtick, dollar-parentheses, angle brackets, newlines, or encoded equivalents. Check for unexpected outbound connections from the device to the internet or unusual internal hosts, especially HTTP, HTTPS, FTP, TFTP, Telnet, SSH, or raw TCP sessions following failed logins. On devices that allow shell or diagnostic inspection, examine running processes, startup scripts, crontabs, temporary directories, configuration changes, new users, altered passwords, and unknown binaries. Because exploitation runs as root, absence of logs is not proof of safety; correlate device telemetry with upstream firewall, switch, proxy, and IDS/IPS records.

• username=.*;
• username=.*%3[Bb]
• username=.*|
• username=.*%7[Cc]
• username=.*&
• username=.*%26
• username=.*`
• username=.*%60
• username=.*$(
• username=.*%24%28
• username=.*wget
• username=.*curl
• username=.*tftp
• username=.*ftpget
• username=.*nc
• username=.*netcat
• username=.*busybox
• username=.*chmod
• username=.*sh -c
• username=.*bash -c
• username=.*id;
• username=.*uname
• username=.*ifconfig
• username=.*/bin/sh
• username=.*/tmp/
• username=.*/var/tmp/
• username=.*>/
• username=.*%3[Ee]
• failed authentication.*;
• failed authentication.*wget
• failed authentication.*curl
• failed authentication.*tftp
• failed authentication.*/bin/sh

What your security team should do

• Inventory all Lantronix EDS5000 devices, including EDS5008, EDS5016, and EDS5032 models, and identify firmware versions and management exposure.
• Prioritize remediation for any device reachable from the internet or from broadly accessible internal networks because exploitation is unauthenticated and active in the wild.
• Apply Lantronix fixed firmware as soon as available; if no fixed firmware is available for a deployed model, place compensating controls in front of the device immediately.
• Meet or beat the CISA KEV remediation deadline of 2026-06-26 for in-scope environments, and consider a shorter internal deadline for externally reachable devices.
• Restrict HTTP/RPC management access to trusted administrative hosts through firewalls, ACLs, VPNs, or jump hosts.
• Hunt for failed authentication attempts where the username contains shell metacharacters, command substitution, encoded control characters, or downloader commands.
• Inspect compromised or suspicious devices for unauthorized configuration changes, persistence, unfamiliar processes, and unexpected outbound connections.
• If suspicious activity is found, isolate and reimage/reflash the device from trusted media, rotate related credentials, and investigate adjacent network segments for follow-on activity.