Which versions of Lantronix EDS5000 are affected by CVE-2025-67038?

Lantronix EDS5000 serial device servers (models EDS5032, EDS5008, EDS5016) contain a critical unauthenticated root command injection vulnerability in the HTTP login interface that is confirmed…

Is there a public PoC exploit available for CVE-2025-67038?

Yes, a public proof-of-concept exploit is available for CVE-2025-67038. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-67038?

Within 24 hours, immediately restrict network access to the HTTP management interface on all Lantronix EDS5000 devices to trusted administrative subnets only-disable external/internet-facing access and disable HTTP RPC if serial console access is available through alternative secure channels; inventory all instances running firmware 2.1.0.0R3 or earlier. Within 7 days, contact Lantronix technical support to verify available firmware updates or interim mitigations, test any available firmware patches in a non-production environment, and deploy network IDS/WAF signatures to detect shell metacharacters in login parameters as early warning of exploitation attempts. Within 30 days, upgrade to the latest available Lantronix firmware as released, replace affected devices with current-generation models if no patch becomes available within 60 days, or decommission non-critical instances-ensure all replacement devices meet current security standards and do not run legacy firmware.

Lantronix EDS5000 CVE-2025-67038

Q: What is the CVSS score of CVE-2025-67038?

CVE-2025-67038 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Code Injection (CWE-94)

2026-03-11 cve@mitre.org

RCE Code Injection Eds5032 Firmware Eds5008 Firmware Eds5016 Firmware Lantronix

9.3

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity command injection in the auth-failure path executing as root yields full C/I/A impact; scope unchanged as code runs on the same device.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 04, 2026 - 21:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 04, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Sep 04, 2026 - 21:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Added to CISA KEV

Jun 23, 2026 - 18:17 CISA

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.

Articles & Coverage 1

vulnerability.circl.lu Lantronix EDS3000PS/EDS5000 Multiple Critical Vulnerabilities (CVE-2025-67034 to CVE-2025-70082) Mar 11, 2026

AnalysisAI

Unauthenticated root-level OS command injection in Lantronix EDS5000 serial device servers (EDS5032/EDS5008/EDS5016, firmware 2.1.0.0R3) lets remote attackers run arbitrary commands by embedding shell metacharacters in the HTTP RPC login username. When authentication fails, the RPC module builds a shell command to write a log entry and concatenates the attacker-supplied username without sanitization, so the injected payload executes as root. This is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though the EPSS probability is only 0.02%, indicating targeted rather than mass exploitation.

Technical ContextAI

The EDS5000 family are network-attached serial-to-Ethernet device servers used to bridge legacy serial equipment onto IP networks in OT/industrial environments; the affected CPEs are cpe:2.3:o:lantronix:eds5032_firmware, eds5008_firmware and eds5016_firmware, all at 2.1.0.0:r3. The root cause is CWE-94 (code injection) as tagged, but functionally this is classic OS command injection (CWE-78): the HTTP RPC authentication path invokes a shell (e.g. via system()) to append a failed-login log entry and interpolates the raw username field into that command line. Because shell metacharacters (;, |, `, $()) are not escaped or filtered, the username becomes an injection point, and since the web/RPC service runs with root privileges the injected commands inherit full device control.

RemediationAI

Apply the vendor-fixed firmware referenced in Lantronix's security advisory and CISA ICSA-26-069-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02); consult the Lantronix vulnerability library (https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/) for the exact patched build, as a specific fixed version number is not stated in the available data. Until patched firmware is deployed, remove these device servers from direct internet exposure and place them behind a firewall or dedicated OT segment, restricting access to the HTTP RPC/management interface to a small set of trusted management hosts (trade-off: remote administration becomes VPN/jump-host-only). Where feasible, block or filter inbound access to the device's web/RPC port and monitor authentication-failure logs for anomalous usernames containing shell metacharacters, accepting that this detection is reactive and does not prevent the initial injection.