22 BRIDGE:BREAK Flaws Expose Thousands of Lantronix and Silex Serial-to
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-24487 | An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC REB An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC REBOOT SYSTEM command. NVD description · AI analysis pending | 6.8 | <1% |
| — | ||
| CVE-2025-67034 | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An issue was discovered in Lantronix EDS5000 2.1.0.0R3. An authenticated attacker can inject OS commands into the "name" parameter when deleting SSL credentials through the management interface. Injected commands are executed with root privileges. NVD description · AI analysis pending | 8.6 | <1% |
| — | ||
| CVE-2025-67038 | Unauthenticated Root Command Injection in Lantronix EDS5000 Device Servers CVE-2025-67038 is an OS command injection flaw (CWE-78) in the HTTP RPC module of Lantronix EDS5000 series device servers, with firmware 2.1.0.0R3 confirmed affected. When a login attempt fails, the module writes a log entry by building a shell command that directly concatenates the username from the request without any sanitization, so an attacker who sends a crafted username in an authentication request gets their commands appended to it. Because the log-writing command runs as root, an unauthenticated, network-reachable attacker gains full command execution with the highest privileges on the device. Any organization running network-exposed Lantronix EDS5000 device/console servers (EDS5008, EDS5016, EDS5032, and the G526/G527-series variants) is affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-06-23 and reports it is being actively exploited; the EPSS score of 19.3% (97th percentile) reflects a high near-term exploitation risk. Do: Upgrade EDS5000-series firmware to a patched release per Lantronix's guidance, since no fixed version is specified in the available data and 2.1.0.0R3 is confirmed vulnerable; if patching is not yet possible, restrict HTTP access to the device's management interface at the network level. Federal agencies must apply vendor mitigations per CISA BOD 26-04 requirements following the 2026-06-23 KEV listing. Check device logs and configs for signs of compromise, since successful injection yields root-level command execution. | 9.3 | 19% | KEV |
| moderate≈ several thousand internet-exposed devices (public reporting on related research cites thousands of exposed Lantronix/Silex serial-to-Ethernet devices) | |
| CVE-2025-67039 | An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username. NVD description · AI analysis pending | 9.3 group max | <1% |
| — | ||
| CVE-2026-32956 | SD-330AC and AMC Manager provided by silex technology, Inc. SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device. NVD description · AI analysis pending | 9.3 group max | <1% |
| — |
Full article430 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 21, 2026Network Security / Vulnerability
Cybersecurity researchers have identified 22 new vulnerabilities in popular models of serial-to-IP converters from Lantronix and Silex that could be exploited to hijack susceptible devices and tamper with data exchanged by them.
The vulnerabilities have been collectively codenamed BRIDGE:BREAK by Forescout Research Vedere Labs, which identified nearly 20,000 Serial-to-Ethernet converters exposed online globally.
"Some of these vulnerabilities allow attackers to take full control of mission-critical devices connected via serial links," the cybersecurity company said in a report shared with The Hacker News.
Serial-to-IP converters are hardware devices that enable users to remotely access, control, and manage any serial device over an IP network or the internet by "bridging" legacy applications and industrial control systems (ICS) that operate over TCP/IP.
At a high level, as many as eight security flaws have been discovered in Lantronix products (EDS3000PS Series and EDS5000 Series) and 14 in Silex SD330-AC. These shortcomings fall under the following broad categories -
- Remote code execution - CVE-2026-32955, CVE-2026-32956, CVE-2026-32961, CVE-2025-67041, CVE-2025-67034, CVE-2025-67035, CVE-2025-67036, CVE-2025-67037, and CVE-2025-67038
- Client-side code execution - CVE-2026-32963
- Denial-of-service (DoS) - CVE-2026-32961, CVE-2015-5621, CVE-2024-24487
- Authentication bypass - CVE-2026-32960, CVE-2025-67039
- Device takeover - FSCT-2025-0021 (no CVE assigned), CVE-2026-32965, CVE-2025-70082
- Firmware tampering - CVE-2026-32958
- Configuration tampering - CVE-2026-32962, CVE-2026-32964
- Information disclosure - CVE-2026-32959
- Arbitrary file upload - CVE-2026-32957
Successful exploitation of the aforementioned flaws could allow attackers to disrupt serial communications with field assets, conduct lateral movement, and tamper with sensor values or modify actuator behavior.
In a hypothetical attack scenario, a threat actor could gain initial access to a remote facility through an internet-exposed edge device, such as an industrial router or firewall, and then weaponize BRIDGE:BREAK vulnerabilities to compromise the serial-to-IP converter, and alter serial data moving to or from the IP network.
Lantronix and Silex have released security updates to address the identified issues -
Besides applying patches, users are advised to replace default credentials, avoid using weak passwords, segment networks to prevent bad actors from reaching vulnerable serial-to-IP converters or using them as jumping-off points to other critical assets, and ensure the devices are not exposed to the internet.
"This research highlights weaknesses in serial-to-IP converters and the risks they can introduce in critical environments," Forescout said. "As these devices are increasingly deployed to connect legacy serial equipment to IP networks, vendors and end-users should treat their security implications as a core operational requirement."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/04/22-bridgebreak-flaws-expose-20000.html