CVE-2025-67038

CVE-2025-67038 is an OS command injection flaw (CWE-78) in the HTTP RPC module of Lantronix EDS5000 series device servers, with firmware 2.1.0.0R3 confirmed affected. When a login attempt fails, the module writes a log entry by building a shell command that directly concatenates the username from the request without any sanitization, so an attacker who sends a crafted username in an authentication request gets their commands appended to it. Because the log-writing command runs as root, an unauthenticated, network-reachable attacker gains full command execution with the highest privileges on the device. Any organization running network-exposed Lantronix EDS5000 device/console servers (EDS5008, EDS5016, EDS5032, and the G526/G527-series variants) is affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-06-23 and reports it is being actively exploited; the EPSS score of 19.3% (97th percentile) reflects a high near-term exploitation risk.

What to do: Upgrade EDS5000-series firmware to a patched release per Lantronix's guidance, since no fixed version is specified in the available data and 2.1.0.0R3 is confirmed vulnerable; if patching is not yet possible, restrict HTTP access to the device's management interface at the network level. Federal agencies must apply vendor mitigations per CISA BOD 26-04 requirements following the 2026-06-23 KEV listing. Check device logs and configs for signs of compromise, since successful injection yields root-level command execution.