Database/Control plane, storage & DevOps

Lantronix EDS5000 serial-to-Ethernet device server: Root command execution on the device server

CVSS 9.8CVE-2025-67038Control plane, storage & DevOpsKnown exploitedICSA-26-069-02curated

Impact

Root command execution on the device server. The HTTP RPC module writes a log line whenever a login fails, and it builds that log line by shell-concatenating the attempted username — so a failed login with a malicious username is enough to run arbitrary commands as root. This CVE is in CISA's Known Exploited Vulnerabilities catalog, meaning it has been used in real attacks.

Who can reach it

No valid credentials needed — the trigger is a failed authentication attempt, so the attacker just needs network reachability to the device's HTTP interface and controls the username field.

What to do

Firmware flash is required; there's no config toggle to disable the vulnerable logging path. Given the confirmed exploitation, treat this as urgent — patch every EDS5000 in the fleet ahead of routine maintenance windows, one device at a time (each flash drops the serial sessions it's bridging).

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.