CVE-2025-67038: Lantronix EDS5000 HTTP RPC OS command injection via username

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable root command execution combined with confirmed exploitation in CISA's KEV catalog makes this an urgent patch-first issue.

What it is

The HTTP RPC module in Lantronix EDS5000 2.1.0.0R3 runs a shell command to log failed authentication attempts, concatenating the supplied username directly into that command without sanitization. An attacker can therefore inject arbitrary OS commands through the username parameter, and those commands run with root privileges. The flaw is a classic CWE-78 OS command injection reachable over the network with no authentication or user interaction required.

Impact

An unauthenticated remote attacker gains arbitrary command execution as root on the affected device, allowing full compromise of the appliance, including configuration, credentials and any data or network access it mediates.

Attack surface

Reached over the network through the HTTP RPC interface, specifically the failed-authentication logging path. The CVSS 4.0 vector shows PR:N and UI:N, so no authentication and no user interaction are needed; the attacker only needs to submit a crafted username.

Exploitation

CVE-2025-67038 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2026-06-23, due 2026-06-26), confirming active exploitation, and EPSS gives a 30-day probability of 0.1926 (97.2nd percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor's fixed firmware per the Lantronix security update and CISA ICS advisory icsa-26-069-02; patch is the first action.
• If no patch is available for a given model, isolate affected EDS5000 and G5/X3 series devices from untrusted networks and discontinue exposure until mitigations exist, as CISA BOD 26-04 allows.
• Restrict management/HTTP RPC access to a dedicated management VLAN or VPN and block it from the internet and general user networks.
• Monitor vendor advisories for updated firmware and re-check the CISA KEV entry for revised required actions.
• Where feasible, disable or restrict the HTTP RPC service if it is not operationally required.

Detection

• Review HTTP RPC authentication-failure logs for usernames containing shell metacharacters (;, |, &, $, backticks, newlines) or command strings.
• Alert on unexpected child processes or shell invocations spawned by the web/RPC service, especially those running as root.
• Baseline and monitor outbound connections and file changes on affected devices for signs of post-exploitation activity.
• Audit exposed management interfaces for affected Lantronix models and confirm firmware versions against the vendor advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.